From 3aef331ebadf79b44fc14ee681e038833b6d0d6f Mon Sep 17 00:00:00 2001 From: Nathaniel Chin <22572406+nathanielcwm@users.noreply.github.com> Date: Wed, 21 Oct 2020 17:16:44 +0800 Subject: [PATCH 001/206] update kms keys link --- windows/deployment/upgrade/windows-10-edition-upgrades.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/upgrade/windows-10-edition-upgrades.md b/windows/deployment/upgrade/windows-10-edition-upgrades.md index e2806e3c0c..ff9c6ae451 100644 --- a/windows/deployment/upgrade/windows-10-edition-upgrades.md +++ b/windows/deployment/upgrade/windows-10-edition-upgrades.md @@ -93,7 +93,7 @@ You can run the changepk.exe command-line tool to upgrade devices to a supported `changepk.exe /ProductKey ` -You can also upgrade using slmgr.vbs and a [KMS client setup key](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj612867(v%3dws.11)). For example, the following command will upgrade to Windows 10 Enterprise. +You can also upgrade using slmgr.vbs and a [KMS client setup key](https://docs.microsoft.com/en-us/windows-server/get-started/kmsclientkeys). For example, the following command will upgrade to Windows 10 Enterprise. `Cscript.exe c:\windows\system32\slmgr.vbs /ipk NPPR9-FWDCX-D2C8J-H872K-2YT43` From 3b8e94507a3d9dc77119d132b3005d2a8f564e08 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Wed, 21 Oct 2020 11:22:36 -0700 Subject: [PATCH 002/206] Added entry point for WDAC Wizard topic in design-guide.md and added topic to TOC. Wrote the sub-topic for building a base policy with the Wizard. Created skeletons for other sub-topics. --- .../TOC.md | 6 + ...wdac-wizard-custom-file-attribute-rule.png | Bin 0 -> 152395 bytes .../wdac-wizard-custom-publisher-rule.png | Bin 0 -> 168464 bytes .../images/wdac-wizard-rule-options-UI.png | Bin 0 -> 113690 bytes .../images/wdac-wizard-template-selection.png | Bin 0 -> 122681 bytes .../wdac-wizard-create-base-policy.md | 136 ++++++++++++++++++ .../wdac-wizard-create-supplemental-policy.md | 21 +++ .../wdac-wizard-editing-policy.md | 21 +++ .../wdac-wizard-merging-policies.md | 21 +++ .../wdac-wizard.md | 53 +++++++ ...fender-application-control-design-guide.md | 1 + 11 files changed, 259 insertions(+) create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-custom-file-attribute-rule.png create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-custom-publisher-rule.png create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-rule-options-UI.png create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-template-selection.png create mode 100644 windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md create mode 100644 windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md create mode 100644 windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md create mode 100644 windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md create mode 100644 windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md diff --git a/windows/security/threat-protection/windows-defender-application-control/TOC.md b/windows/security/threat-protection/windows-defender-application-control/TOC.md index a8f8114e8a..731cab3d76 100644 --- a/windows/security/threat-protection/windows-defender-application-control/TOC.md +++ b/windows/security/threat-protection/windows-defender-application-control/TOC.md @@ -20,6 +20,12 @@ ##### [Create a WDAC policy for lightly-managed devices](create-wdac-policy-for-lightly-managed-devices.md) ##### [Create a WDAC policy for fully-managed devices](create-wdac-policy-for-fully-managed-devices.md) ##### [Create a WDAC policy for fixed-workload devices](create-initial-default-policy.md) +##### [Microsoft recommended block rules](microsoft-recommended-block-rules.md) +### [Using the WDAC Wizard tool](wdac-wizard.md) +#### [Create a base WDC policy](wdac-wizard-create-base-policy.md) +#### [Create a supplemental WDAC policy](wdac-wizard-create-supplemental-policy.md) +#### [Editing a WDAC policy](wdac-wizard-editing-policy.md) +#### [Merging multiple WDAC policies](wdac-wizard-merging-policies.md) ## [Windows Defender Application Control deployment guide](windows-defender-application-control-deployment-guide.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-custom-file-attribute-rule.png b/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-custom-file-attribute-rule.png new file mode 100644 index 0000000000000000000000000000000000000000..a285f6a6bc494b5321ed123e62e933b83041d884 GIT binary patch literal 152395 zcmd3NWmsEH*KS){TA;<<-5rWci#x@O7k3F3oVK`2C_zJUC=_=s?ogyS0TSGUOMpY) z=Y7t1exB?6IzMtHGkYd`_Uu`5uXV4;4{Gvn&`HssJbCg)Q9(xY$&+XBCr_TXy+VEL z>A>-BfBbstt|>3|q|^>E=NL;I(WXhxW?AlvgA{|>{i7&0Yy6lPEgCIZlV;!*^3_^ zKdXK`>b`^()WXJPBG&i?H2YP|uR`iIle)=;!1rDU3%xNUd}8hQK=zN7ziQ6KipDe7_UCILZF+F7NW}awxe-Q1STAw! zJs!?S3n`lH=r=@tk$F&Ob;=a=>!gKJf^SasUkOq z&fy~Beih+)4qH{`r)pjYOP$pP%0hwXiCY6MXl<3Tr#G$ZqX`4>6V@Kr?cYA*7p2%E zHYgHA5BKi5R3_Glq=J3?7hW6cl5WF?!pGoBxBI0x;}_ZPu-`P0;gaKF|F;J=7l-qs zt=AYn_#1$rFR8yujeKnxj*s0^_S-f9cMh#%)fczOWq<8|-k=DxUip$sV1Y82Q9h2G zlIlS;UC?DLw>Mhc&w1<>4X5NHh|fkXez+6??(q&cl1pMZE$Xg~q<_tAj#=@usb~zj zSoIs1;ly=EDWsml<3L2Qjl3t0&9og)u~3Gv8EYrD6MiB8afI--ZCp zPOX%%SkhDPBmc2b@3^*iDju&%_zI8r+gJ%l81rmyE8Kl%DM^9Fy)(voVw^#E{T%J4 zLBWi%WEyh#bIndrrct)E(~!0z7vK5^a?oIpyD$T~)rrbAvqm*O2N|J7?}9i4Wjv3M z__uHwJ-|CLg!0 znTrR^AlANdlc=83d6bhviJr&}G}p#fg+*^lGaO7!tLQDndCa;#ulvp!iPPJi}A*c!HEM;_>>nmvdFVl%;V4gWFQipu&Sm1*P+CHli=bUz+na zsxH+zvSfH2z-E0;g-)o^56M5>V_u$p$-?Nb*|U$Ct3JKEWTRnC_|}2!x^QBf2X0nv zGI7=m`REl&DXL{P<~wm^OU4_E3Rco_MT zz=~*v<70Qbc+1s&QB&i~K#DTs_GAiCuj+t3YjbwS(YI#{kQIn%5P_lB(4N?M;+|Kv z)o}RQjafWK*{vCG#>GBP{lWSzRgg?y^2`3zvpZhE-Lj*RK=^r4Hq}~3qaRf$Tgv&q zIGxBbsd5VYAIhT<)8lA?I(pd2*cQwj&zb1*sPkr>a53JvlNEMYf7wXbcPQioxN36rHOunczxM0Um!v?pz8_)QP2Tsj|3Zpu7E-tQ<^+7n`&JS5ae8j_>a9r?4$g`AM zHUrvgUJE!`OnIGgMoe|8tads4bqA8k2dD31VqlrtTEDL=6>`a@^Wg+mbke>C6Q7yj zvuPw(*BRn^nP+U)+b`>r3jR}iVWJsTZAGULv8``*`mg|~XfR&j^-+aPg3 z>K-Q5(59Mf9IlSS2G!VCtd+iho{kV=L{4pf_a2<&_vIq+8wcz zw*OG?NHV0u%pp^(eW#nUkLI^##K%&DpKG4>Ed7nTkN4|K$ai;j_M<%ywJj!RYvMcPXG}FnZWQ&z9z4^Ewnt zEuy%E-e;xp!C|{;A~+1>UP>Y8i*LBDK!w4YAjPY%ydD;oQnoZqbCg5 z5YVro2l^ea^7eOg40jGQGgJ{2UC$#OUE*!A-o#RCe6^uvZ;Hnh7N&7{_ZoPV*_m1( zfOvh`*cAm^>s*wy$a`rh!qz)TPB>bu06O#fC}>nz{RlR*2{E35&|72bBIY;<|KNGcqUd(`!nP!maR{VQF$cm zCBT?IM@S`7d~p@T{=$sLjb49yK?nd?uu7kI70woyim1CBbUBf#FuoKtH_9YSU={6+ z0%K>DhIP?A&p59kzPqhOOT`MC(VScv{ea?B_a>oSi{5+Qe1(#&rCtRAXJEWRAA?If zdzn#F7V>)O^yg_lPvv3mmk~GU=U>k57?v%n5iU+_Govc4+owy@{Q1!bx9ZBHiiJp@ zxjL^F5B!A-5k1wC#7Q1?C_lT2XB_R0YCcbR&F+uHvioE1V;p^So$u1it&U=@69JHy z;n-cM04)cW{HxZtp%?l>~0t-PghVovPr+~K4Oz;JF&%)K*7Ogw`)q91-W>A8)P!G zZ$M)z9`q(lbjDNkB!sE?j2{2)GhH}lbpEs?QNId_=|KOA*V})*JtUU5;b~V8)^&AZ zEz99_a$zjl1KoRPVwz(|NqN|FMowr13>wTl!uaxOyMQjm4_W_}SN@}zt1m#Qx_<(TNsF%p(LqM-fhFyb`oDo%;#RIgzlvRDB^%T6dmBU zXwA7Coh#M!EVT`Hm5PhyT1#ZU`SO(>)wZ2>UMgW6OQ5+2Bh@6Mx(u=h?YDl&D&A~_ zk4NlsxVqch0dN>Wc6Pr-eWOso8UJj#2@Ru(?vHO{1x;kIA{w)GSxjS-T zt2}lD?wZR)BA=;1z2m}Q9UE8?BuWPDG6@Fy<6avsZTVe;n5|H&yL_|W(J?N=d2B(jwHu%>vw4lyqCQ~q+tKO}96i3(?NVwN{~4!3DN zZf`e5XR)btEvd{5^)-F`1nw|$yqBhVE?(?PE)`gE11)`M^MKE zy&%H6zY}CRV3>6E6rsR8R0$ouY~_Ce4>D-YB^vNQm}&f~`;YejfSC;G$p3v2#*x$0_`ktb$_I0!e{`Hwj<@o5 zS9kXxjLZiVe~S*+l7CT__wVH#W0*8)6(CW z=)Hzg|98*z|G{lK=!EvY_Pt(WhD#&s{2p<_TKLw7N9Y-!e2zyzcvOvkn(ka}S^O`ew4 zrl!rGe_UN?hY$tOWw1^qnlNUwkW zWufZhjQTBh+eE;Kq_nVRT5GW+B4KNL7$6K$7h3U#2`FH%wBdOr8lkn>N<5_anI2n? z3$eGO&E0<7CpK-ga^BAa=I|5Ch^ffYNnHP^*>HArp^g|QC6p>sJ>ZGbdQ(e$1QQutSgIvt;=YO_m1Tvj2cB$muK@n( zF4d-Lyxq+5U*x2{pWC7!8C<8rigC^QlTf)W`Pog zY-}0Uxe+^8AEbEc;$;^&KC&l$eh4RN+a?B5K`qD2X1pWsWAHbFLgqywHp<7|f-7aU zS|uh7m+jaiP$(@Yqum#>woZ1H6Cbtky$~{^9LF5oeU;g7do=Ht+WgYiWGggEK1kE{ zPMlNCz~LL5DHP4UcP$M~l>o~5OsrS4QvX^9b0o!krjW+8yi!!HHZ@iIWDfNo$b$jx zQc*3@t*zDMwIw$~>+TyKONG>gT7A|k&%N=U{p`+Mwp9vwA^TJ2knhO`{!72dX`ECq zMvs&?rxgd2S@@{@#lJ}DWAN1mkZxk$#>{mhjwB4#O4jHUHs^y9H{lI62a8rJ*ZtvH0zuQ`QPyEmwZ z*d(-UIP>MI*y+{M!nqc~>rlkcbPivV1hp;58(1>koX^KQI2eBjlAfQ&%GX*5QT0>D z0FvFc_$%KypAs+8OR^;8)423vCM$8oA;%nXfFc=l9s4Nu)8&d;zB+@6P5csXcy<7MS$gG{VSUkze$52p+!cQZ0D~iA`0uUb1 z$EFgKjjO^1wt1Q%ssua+J@cq=7mPgZBe^w7n-aX5cG9pDv;G~uo0XOJ;O2Dv0AD`j|3841M1^dSmeV4G;l@JY3FX4k1rFqbe=EA^b z@2T}d%n^!wdw20^p2D53zr?QJm~SEczh+0_uhnrii>^;`L9wXKz^93S0ky6 z{F+Y)6@Z3{iw;e*VMEjVm0-E?#_pd|qZY3$vWD`hmhU(#QdGFtSFFQZ0dkyhD+wwn zM6+N~QgF-o|5Rj-y24Xe4av-=-%=MlDo?-kzsIg~A<;X|QF?D`ZjuRJbHjEz$@3{u z$y_+0`vQ=QKFSj5Yl?RBp2;u?9y)Othn!_qr(IaQv_Gvi9fC`6oZMHI0VFH1Z+0?I9v>8Uk?X)Xv_nw__5Xda`M!Mq#0Fg5 z@6EXN5o&P>Wic|mqN$Us@NDt%TcfMJj770oy8XI(3zS`g<;O*osv=MDIlJI3qOWRS zBnSkc@>&kOyE)rA4j>+}SVR#xT!@qiMBQ!J9>!9>z-!#pqRciOD+q_U{#ORJ9%Ufw zSLmqq-6*pQ`+P=_T$|Blae{!P>3CXqgXwusQO^hT%XF0u87ad4o>#pNAkv98%?RTLgvsRAk1isR4WE^YvgRho!2PRB1s6n0w?aS7g*c1amJ$np0~pu+TVWk< zqL8UFV}R%vJ3hvVIytXEp$+q0b&Jq&h1^iIiHStwQ~n$;ukF+dW_Z!)>J(0!qE?xt zZfSOA7L0IGch8*;uGW(9TQ~mB4bmu04qoKtbh}N{Q$05PIbp7>UQwa!ZtbRQ5R*A@ zRsv_vdMg=ygf7luQ`L%3sM#x);VRSN>4h-+lIFfWv|SS zKeeYdhjzljfa6841r6hOBCQx3eateYoPh>aSucZsSM{)s?*`Z`*wZLgdsE#pYsu#oObm1QiVM4?$nWj z{;i?f!Hs^~uYbT4jHTJ{@~|mWt?1$;4R%gv>Xn?YlBRik%ZU@<#K6KQ0Lw5GSjfK+ zYJXbJai9tv3m2wp1#43_2zDEvY->*VZ&`#T-#_Lh{)>Q)$dzI`%%E00_W`ArwJWnv zX201{f@j}z8?(;R3%OGaZ7IgAAxN4rGZdC9>Z@VhCzO&E;abBlCp<>pE(n&&NOjl} z2Fz!~cE&cIdZQhg*#C02a)K-iDiKS@rjCk_ zLrbyUd{CT9r!9~3-z*f}JYd!rGdn{5c;4fb8>$dX1ouOhZDe?>EZ9ivh<}|&+>Vgn zVrW3FPyWuKo8}@AXHFW#nc2>P?AqMo1*$lmYO))}d*hj^myh zGBBIr<_SD38q)T_F(FvbXWivH4wbZ6p0$_@gzHS5pw&o{jQ{B{yb{keZ3wB8Kk~i! ztJY}#+V!=WI0Eg`V@fAcV2)0~iGLvTr2BdWp4Tb8pStAPW8O*^vwXfcNBU(W*b zI8}|yACbd>@yiZ?`CN#TyG>ox4TB(fbz|LL^ta*EeJyW{w6; z(jM6moAE|Q$DzsC0=~uSt?*vQC66dQ|C5eI6n1(7^Z5Lh#%#)7;0^i^^~8x$gy3to(PWBlHmGfrd!G zW~bKgmdecyPRiNlMk-hB-YZA>&`k)34oYXX670@v{k7mSkJ{#m-tqfgLE^p$C!3G; zpCs5WUGjBM$*_)~TZf@qFZ-MH|=b_K!?ER9%0+!K7$B%fQ+2+wuY& z|K{u>mm865SiH{Tjgwyjc!U8ihu&Zwu5iG%326nnvKaPvn45z!z~z!ehakTOH1wwN zoC7BB<893MIL^YPZd-%`MJQY@TsT@dXTk1{3$@>rf##x=X8Uu^X+K*qkC{(=ln(?2 z+|L8eyACs{W%lKlC5ARRL?iy-8<0~OZ~g8Z=ITM{r*`TxYZqZQfo`OFJnNmIUH5Ps zH1t>+5Qscl3hoLa=HtmCtH$XB&;D|vXlWdqI(IotWs@t~y({W>yPgg~U30)SD zdkY2ccdi{y>ucZEo%E{0%%kb}^b$T;*RoHD2%yCxdA-dMSv*nC zh}L^J5g9Pkn-%Y!&UbobwU4)y~^`JK#fJFhQK<+3|%8GIMrymVRGoM;;+7jZiP zLUM&<(wcgg$+qU}H=d}A(VYUv4$Pt(sT!O`i#>D8ol;dB0!=I7$1j|t{5VS*zTNd> zR$cxQzC`0%ebt^{u+`LZ*uuNL$pPS6+W2(=0-QW&mq0``1;w?A0$q2$h#pA0WMNzR zW)x#x9RGG#p37cx1%rZlf2v;HUb}7~-+DPO-c75smml9|cHpkhgX~SUeAnb`UP3H7U;#yo}t~M3p-KyVSyqD zQ_8J}yZOD30hV#kpO((?*ccN-(XcS%_KlHHjLabNs0uVSj_a>>8EOFFIIXYxGH30+ z*NJucF9Vtz;3)CC%lV>t0Sjh}S(BMAZ#Oqe<8UO>hz81C$e=?Oi$hBnv60t|=za>6 z?r`%aYF~MHWlH5@H0E$dc1s6Dap9{Dl01Ah$lswyXHD)sl6GLIAGCjsGm!A>9c?ac zBfDdp?< zR(*5D)2!n#qLx_5cOz(ijD+taf4r^pRe=x1y8F+4CkdBTr$-+9->9y1-JSYv^L|Pq zgjIBB@T}i@8cFzsIq2S=nlIrDb@%g#wFZRZW!OwM4b!Sb;<;T;DoLbPsfN^Ka0VA* z#814oy^|2-d{J{+^nx76?%_4cMXJNdtq;Y^S=A!1jB)4ozU=cMDakmO`kvI)vC18vi%MCO^?n}*p#~QQj*I}QB^$Bkh+zI7e^Op9K&_hj$p(xw z;xLLZ-EQyc>ea}4m`aaU39#cUK^S(kTQ;LMb0wi3+Z_syFL+r{T*HU@x5YI+9+v}tC{y>;7*x8fpLg{og$*dNu8>B{S~TdyaodqlBxls}RDzBFxMjvV7s=VT?2OvH^X z<7;D9q#p*HyzIe)9!zk}lBaFoBx5ad6 z3!Nuc>&^)-$>w6>1POv0g5v9@nPP0A$?*%b{flPZ_E_J$6L382SAwm5JTqHeqf1Z< zKdGg>9uZJeyNy}qWa}uywC z-KzIx^0RP~j7{V0*YvqsUk1cLQ6(S(VYp~;pJxd|ze%*F0zQh~1PDW(_s>-8opDCZ z9;xDnd{#Jh=be@VHPMT=rOa+Tb(1S>V`ScN;i&mQPZAMba)UUT+ZV(YAp zZ=T9Cc0%TvL-t~_=7sPaW}s(|%dutzxO{$p&|+?6JjicYvP91E%?cGRvg1UhcDqDP zFo*C*RnK(;WNp5a&jKNIjJ(OuVtsiVl>_1>1ue`ecyQ_~)*c5?LWxF9w+K9VesPM~AUb=j1jn?sgW+ z2--+(w&tK(j#s;ElybKb7*TP*`&f{*TnV3L=C8LiuxzzkR*$qR)mo7?6NdSx@}}|K zm#g-eXtSEJzKOrDpXkvBjUk)U_T{OQMCnJ>9gAs(s$4ymV;pDb5pI6zZm*T4z%z}{J^(lWJY#4^7eB<2O% zsY1NJ$fU)HEp^DQ+Y%Q6#eXp$_K(}dG3G(P4ksnXOCBhKX}T4Fr`Sbs%v+{X>EYb? zIsbXZ<6Oi?15BnGg_P!>q!w@9^sE+Hj8}+O?Tx}9{N@*8=%B^+`}<7ew^;!;v^+9$ zI6m$eQ=5mgagPwJH|XhOsQRfU5$mrkCqr?+s_luLbIPZ9QjNlt3`!}C>IiE`k@l1k zU_%0v7RHEhv{t$0Q>3h#LEcZHOy@{K9CDejj-kvZ+>#vO55HQ~?d=b%%BU722|;5T z?FKK4AMykPD<O(zli>xp^nXMS=CERRt2Ia&e8Fv8+ z0~KH6V#1)Gqw!T1zlD#L48odclpO=SBkTGnPXo~!vZ@-5L;$M5AM?GDax|Ru5+>F- zf&i5e;*%?$G<0yT!aZ$_K~?lvK{b!>tsJzaE!j;U3NQWRR>sY#>*$psz`!K*QNBxt zaP+O66iPfwUY-Aq6Zu_QZ4g_iGY5_tp+!12^65QPOf2Y)gQoCPsX2RYALn;~`r#}W z%q$#`c-Sg2Q>d~YwP_A3yJ%asW_-Nc^tTTotTCNgK!9x1ht&(L8gdfij&;TFtDb(Q!9;+tX< z*yH8CeYbd_zOCGo$JAxLHoO7(u!e2bb(|q25)oIAmU93p{&U~2>M;t4x9)YDu}B zPov#)F2SA+kD{94Pc&cFB!c&5tq^(B+GQWUdZ4w*#DbDknQYvBF1UH~D|!)?#O$aj zm+^;+q6%T?pdl|)lp_W5Et z+86svF_STwwKJ?H?0xCZuF%MKw{Hr!(zF3u8ZDMIFnNlX`)qh2aR1}k~U{@6hM-bF{niB@Ru0=&*bRy;XoY2_$!|WPv~$;M8q+(D!!z; z+YiDBvzxQi+*#Le!CUcWvrM@kcKwWeU`4$=yF&!#Dr&iTWrvuN-JBsGYwMT&ycKsD z+2o?ivm!*x*{U#}+SfH{aVVmr6vdkmwuR)yWVJpm(onYy0e#(+SZ;N4<-hrad} zImkdr)hK)EGQ-{ChgwhGTAuarx(K_8)~HISRY`4z(}bq}knd=~2|AqqA%x_5QK)ap zV&Y52S!!cSn(<^Lcg0#nBxAtDv&?09pi-6H25IgH_YjO33o){CDd3RKGCQo@GXYB4$AzjfoIp(1-HIMDg3DHDVVi z-i}X-l^`yk=bgsFMq^(m24L&!c0^obkH!QMns{?aY`Kc%Y`80zlzLY4hT zqi2L_c~qHrdnCSwpD5ND6Dd^#+z{x4bkyPC=*aG8YGks`6IK#sxMr##XEmOKo78` zrx8h%)Xe%f|HbDedIk&GNl6xWRdoAwc5;2jHs^#y|U`{Gsw)AiAFIaB`eo zvHnk1AVyGE|F@)fHz#N1CXi&s(By$z$^f!JnTa#VFEPvFO9l$iQGxv^W-?_}60IVh zR-@M&&5r!!^URJf_{zQ$UdJBxUX&5!bQF!&WHib*wgBXH+>4ISD%0h9(;P4)pQfJU z@Wo2Q2Ryf1@2PeJFQ0Yc>f{o&c5Uc_S6!mJ0$`nu6sSMEdJP}ISyjFtdcmS&&73`h znOm-qAuy$z#H?YB#NsTJI}jOZPE5>}oB2H!B=_ux0CPp#Ra*Jl^96=ER@mG(R*OJ} zpxlsFy%tgy2vzZOWlbbzQ+KAjC`JvcHjO@{RohPdtKG)=w8JE5d-}!Wd!nIr9Q(F( zCqrX6Z*O@rp|vrbHC?Ut-8z=k-=7;hy74BNL2Ld*BLJ1NMYcsZ7BMmAEqC$ANBgEt z49kYN=|pR_e#C@QRejk_Jam;1eoV?Al`UnzO*QbeKm9(!^cv)Ii;qD-TDNi4P-iE0 z$jmkqOXNJCDptn5T>8g)b#k%RZX)4%38*U1CBT06P%g9zgN4;UpxT+OVe10hNAH^~ zRx9F!wJS>Bm{_wygpDq0vc|b{tH%x5%0aR+9nY#$imheGZX88VXFT|$D==*+p~jq} z>LBphT3@u3j`GwI$mP|FND?7M;VW>9N11WP1s`YS#q4-C-mNti5t)s@3J8@0aq#ww zh~3CE@`ed1@TN%iVfpnP!oB+D_Ct9f+eK`t>QrQrex2^v@pv&=`Ge`;B%dUQHKt*mBw7-9VlzTJETvt6LL+5ibn(5vF|N{Vg_@>%+DeO~ z0M?m)wqJwP*eI~q$jbGUvG(pzjBg7Q-}%Lr*9T{jXpehKCuXM%Z3g`$^w$nY@}M6F z^HKM?WE8I)NdQc+(s_$H1x$x#Wmr;p88 zCAGWyE=|$waron)mu)%wK9ox{&zfRpQE4JaiZID?P;Gu!oMcgg^1Sqn+OGSsmNhN? zv!m*@k2WW%Ud8(w4bbll*(ML+`~9cEk7P4s$2;H=R2)3DGflbn$O+>dZ=Ph)DxAJ& zy%+Act}R+A=yQDd(cHgb+5@kN(XY*B{5H(vZX_9X4pDC-Z-)d&&GtfFT2Aqf_}Uuw zSz9@zc618a35Y23pzaM10SoJPvJYArgGYeBWj?(@MBU+3fkIN~a*tj#`~7{D#ZpvI zSakTMqqc)Cc%2LL%>x;?fwu>O`DHwW(Wd+T^mxXA`#XdPA}%|*mShqnGHAHJJ(oxA zE^O~7Hl{@@oEv>E<1t;8_g@6Uo6{BnvOpANA#% zyuWNdZ=KxS+^dS|Vcs~GB6tqoY@n|EUmQV2vxgqtdm`6!ZB(H&+5DEReJk5CQ7dOpdPB*(ZrjAYWmgJ0(@kG&@(J^%Vxf`bkvHmz-Kb^SkV#xiNBso#};e1jT1<99Ws zq^s@C2s+-H_sqlFO24nf{f|#3f*Oro(Cnvjx5?IiW6o|thdQoGAK5DJLpNF#i6!Cc6psEQGydp{ z{)>pvuDeKE#&6V*3v)>d((YHtIoR79zCPVzF>M#y82V;0l+3bFv=ST~+ysD!T{NBp zUo>IEP#s?Nj~RDvPWq5yBWCU3L)Y+-kFiP#f45zkJ2fDpx#=rzB%7P02B#7}$3UK` z{M7X#h4<~%r;8X;vXJ951aD-zPDN9H9IGG3Q%WB<&O1r{s0Qp!2||sPp^mD+*3rY$ zg4K9;NUvpJGlkx}y))mKu@9*HyS<bIKkWizuq&2jUourFak$oL7`OGc6;2ph^wh!qoY}8WF{fwmLl`Wa zxP5v7cxJwG)3Lm5+07l;SdXXI8!e~>l0dhDfc0A3Bd?R0HKg#MESmYBetmxGf86=9 z)@dx*h&a(stZl8^UUp?#`wXuE9?!5?suXZB(G2HdNMnSfP{tH_sUn zO&QG-Q_+0Rum@Hq{?m-wE1M?x*1`)B6dYf#$&Sa!arksSfMvH( z&7ewFw^?+srC*QKJ2blgMtB7Lbn;`^d)}G1(Z(VDt@E#ef}*-p7pJtoUlokp#qL_W zvt$ElEkq>HhPR#$=UbVo;nyY9U@ggYEmfB&ogXr2X5(P3@M_=|))IO+on)NlO#Pxk z>R71*$wjaIemgXsdUhvPsz>B%XIO&YZZh?vJ5YuR*^BCQQtj%CAVQL-XKk#!DbU=( zoj%}C=U6$%&U!4x5m3zu%wy!=M&j5|?)JQuBAE)JmsFu(>~a|RJgx^jj)4E3i#ps9iS2FLu%Frt&g@m9ztL%w;=Y0+04t&y{tCjGPGI}doQM(-R3>Up4vMw?H zV=XssbGHJ%B*f-S=20Wv2MoN&*visk7p0UdWqjePPZt>%N6R}T(^soFU$bqahT3eZ z;_u;$QHmuAo9lx3dy6qdZ;o2Pjs>>KC#FmFqR-|_dDg;r&dRdCcom?pu_I_Oz$%-_ zRo|EeH_-O5;nil5lLv`pe7UfCQiTWC?rTWr@$RMFWv9OeR)^4>`7hXp?!-&*2tz;) zqvd&UbOuq)fk)-$p}%XU&oCwoTgsqlijJRG`R0$AnJoh$mx+|lEiNghVca0!Mj!qC ze62U7{$70_7E|KHgp6EY0*$gY$!L=gN^ zS<>>b>QkKh5A`D}-@@?>*)0G2ISa?G)Z39%vG8Kcv=Tj9CZ8YYpZc&&H5hgHwV3WA zbol9}76>-<^a3_HAgVJz^NNK7U-Dq7^O{}Ro_MD9=imEmFP~VL?U1nkp&Y!$+vGjk z@<~<)W+c3tSDeWG`KbK4Hog&*WM@;&R+tt&RwRvN3WFZmM>WpNB7Jcb%8#WY;eJ#a1tmdl1A> zWcxF2zlAV38+%DF`n6lc4dgqvCOjQBz7fSio{X9OL7%i#WPJsPnZ}e9SFoaLJnpSWtnp+? zy%>T!68B$BX*McZpfj8@>a9tIP<1FokiVNKr{{@i7S5zmHT+QOh$Cmj)(9CFlX#A29*T<0BQUw)A;ehnX$*cBeP;} zq_Eo-t`n$IY%DtcWJA@-Abya3a{M#6LbALiJgsK2Yaqvy8#jI|yY|yoJVqpbeZi0E zFOzn$`D2+_*-YR@GN(SKecT$N^3CnUJbdRX9+Eo?*Wwq3f6f1~lDSb_*u%|U#RBrU zI~~~Re%!cDYoC)kt zEea269JUK(FF4ZQ=2>k$HHu3i$g`z}WajJlHt!#E^ncGmVYXV3`H9Zah|MzXyZt7v z>>6T9xNszDX;yory`n5?5lpev)*+(0`_)9WthC}*LkxVduOi}yzu4nL9>>! zsnAaW?Ycm0oZV3-$q^fMKG3i1$oq$_!$C31jtiE}S;o{7_HdSJ>l3oosS z?qjY=ex>VXfOt!QS3|UnZ4vMQ2hHm7q)%M3x9Bii{-@A? zx=bHr*x>Br-$)|i-zcDC)gMQJ&tZ^E!e?!px6>hN{6aK7IQSL1Zx0;;!Z zzF982AJ0A#_YH4nz7A`pY)K7zyv)7;)bo2kn9wFtQ>gmgfK0EoH#1+9Z4GC;(=5z9PuPETKRt;>EY`IlBdmhE&hlQJO~>db4IDMK$YM7XVEjO9Hpbc_FQQn38*LJ6vV1rgQP_XYvPd* z(8)9|&YR)oLig1t#C*N>n{t{c#Jm%ZZArN7YK%STsK3}!L1dcXmIAvWP8uI43BH^E z$QaT0(sJOzx@*nM-x!8l;G3^(Ua+&U1_L}gC;rc7z0;O+P*IU_dJLYR_hzJ^z=eSmD zBMrEiYQSX{@SF3pmCD4r=t7WjEvA}A(6R&&R|(9N@ir;pcfZVHjb=M@rU+0k!q2Q- zSv#MHMn ze@(~(rI8F;mA>bI{|wf+?5&8W-O_i=gZ`s@rL;*8h*;#d{;2J=&y&cLKa9q>82Tsc zR$kep{El;i$;UA$QFP?RdQzZ>8+ zN7JEHDU^%$dd^rX*Y3y?0ufAj>xWwAMJ0EK#E9RlFZ8+#oBp8_el4H@CCESl?*x-A#)WifggrPH>mv4h2eacP9|siU)U>V1-iLJrs9$ zw?J@recAu>p6};Vt}CDN%w(RKS@-&_6)f=SvwE?yX2K4W)F8ScCsdl++=eSxFE-uh zW}1-$Tlv6F`;5DV=`Og06MJL3KP+;7^R9xbUZ=ryJ`n~R&5&F$qSTF1#H7i{AWIws z857Rhf-Gk5oi29AnBO;I6u@7__wsLMN)5B)-6LGAY;@7yhQms!TBz&4ZfRZmxY91a z(-@6wG0xd2wmSzA)_HxRQ9r0I@nn3vurNG!08T^q>(0S?${PHBPfh)J_DOo)iBB)S zCXzHH!;=LvgK6vq4e0lgdn3?0NJfO=uhT_;2i|mqtOZwTP$!%|y_l>0ww2z$2*-0N zYdgYTaInBWZIqY6cu;xJeBRo(6z5cl)5&lCqnd|q`V=eD@RV=&7?y^U4%rl!f`$$A zO3W>sh;*MO#xN3_OsYfnLRs7dlBhsqli*YWsuF9>Lq0SY}XT>&0%7E721d zqlS&8&^(hh=~^k>haV5|^9e3( zI}NIL^@9uyUO_j`P^BIjz>7fdheD!@ZV~Y*TkG8UslUH^@qogki0xHk4&d!6X`&(_ zxOoE+>?1R47>^CW@?ZYCV#JH(&s$zwI?nPDO0~L6bQjVM{2AA8Cv1I0@cM(Yw(%g= z2|;u^uOr!fg?@qEVhtGq@03U8sIcXk`9Nx%(|~6HtEzGMt7JJ%Z;hQ`nfP=uU^y!5 zDDPYP3$qq97>i}d3EalTkR0*bs`NKKB)UORs@vHAfi_WL!5YVpWaflBX(QQ}ezJz{ z5$Lhsqo{K@xs|6b>&jrR5(e#iCbp=e+To&O5lWgm>1YJa(MU& zWgh+{e7(K+N@Z{WzyHgf6MBlGyFBv}?V{N2atvQF`0Mf{CE5Y>KDoO*seUoh-_9Z6 z%_8WYj`4J(8MhZ*J->_euJ}(Kdsiu>B=wM3u;onDtzN9`sW)k`mo!W&f2-f>=Bc+i zktb280(o(l>E999mL8|-TA0K=RxR%Q0&2!w6lWe*!5Nk*xTtD_lElZyzS~*8y4dmI zr`!~;P+?s^N~OX*$s-L~aBqeohx**llnJYWwxKaTKJ?^FP&pGOGj1iRx1XT#a>0f7 zpZ@fu66bZ2onAy4A1%2*_3KTgL&IbGQTV+??fv`rRso ze-Z~;CX4ifH3)}n#d^Hig~P9yM1kb3-}8=G29kfk_8LI3$K0~F z3s^a?j5cO(Pl|2-=YxKYWeqlPw~oCX(Gl|>8oH&S`ah)g?fXJPP22GQ9~ODjcK)Be z#&@luR2jqsDnQtoF*>QBLS6s8`N|@DI6i{kOoO97RB=XBt8VuQ1=ubT*5t$_yBzD` z5u_`ox^!dMOGY+u-P)Pc-Vrd}S6*7o?{$Y9CiSFZ=(2p_ExEQJzDkP_zux*N7>u;G zrF?eD@N~ATK_=5K)U(&`-UJj~sV%;%+`zt_^)0o88x9@%U|iLAe1AZ1D|~QMn#h|z zd~NvTctB&=sN@JRhSgtRNKh^{+`#KEHM@Kx<#Ny6FE;F#n2&vzt#2IvGuTG`&LpPS zsrpQePHNnXK~?g@jnFv96oCD__Yp~D6zGH(3%(`{ z;pRwi|2}xSwAMz8G(%Ykw&=q7$6RBV#Ak2OJ7=3yN454;XFO-imFkMW6k|KfEHSTF&lII;!3uzlsQ%usZ!_L-U(i$ubqe;w-}{#q;xlZ+8eR37)cv^ z3(>GR3}`>%_mgl*UE!+_sl5$u0q;yI056MuTtUkuVCRCyc7fJ!nZ@fjou^zJ9@X20l z@uDXsVNmLaNGmRr(|ccHd`|s^+LJxsSkx@N`ZOX+dy5gRfor<)QkHguR}hRQB?jWB zuqq^1e~gpkVmYSMl|4a!18Ez2lSl6SPAHXE{P5{|*9(Tl__k4}YdR;WtBwG))|aL= z!Ot#aQW46QXd{^OjwXR7mcmE|f9WFz1Q)CJ(8PngcRdr+gsib$8X>)pAH*tnJ#n0` zECsH013H(7w;u%eqB4HJDivTJR`71y3(IbQ^!2p5nuA6>jZbWD+rtkLvll<(2Hm?O z%xuzBIK~s5XRxRFB8%`vB9g*$FK_&GQlBc%Zq6-s8ud%Q*C3h_kYeA{eB6RiUale) zto>}8AKWMyZDOu0@pyve$w;y<%?P_C4ch0Y&XI zCf`GJcwS>H`2J9A_pzN+-D=Li8hko@iW<}#*1AkPxfMi1_6;$1i?S|KpRFPb+*J!UK=G#5LwBI4^v3Q6siZ?!xPc$!D1sa(8 zJrjI;n}JGPF@}60_$-!7=V?OzZ+E`dBk&V+30o2xIG8q-PbQj;*4wY}eI;Kk)al_Z zNsFI?mCS)qqF01dHj77aklB5)*^^FK5PdfQ-+&s@@EoU$`~f%8kW#$T!E$L#eWi`I z2lz(_S7mp!NUoiT?^H+&Fp+ELOF4!A*JGQ2G37Mk=yOzsK?aZd&9|y=_`9EM2FFv& z-jil2HIAo*7w}sD_{D~E6P!pFiScZ!DRq#=De6{y{@dPcC?}y8L3h%jN7`D9WJUO3 zf%pz~KK&lX9Ib5!*t->}jcrxmc}a1!;MgE98en{z-93Qo}eLlEOh^7nM@9<+IQP((fwZ4koskiZ; z@T0Id*?)Gh98|+s5TRd*T9Y2z$H+u z|KJZs&r44e%q5zR6&TE-3EA5tqgk=S&0l26sh8Gh*vJ>DUd-AOc^jqhdJ5!u73`E` z#?G4~f{4O2mT!_Avr)*qKQy+2F4=9UnxK@c%=y)>7>GjTW09Y#I*(}Vl1)010076y z0Jq1u6Y+=5szph)!;rYMn>Y8)lN>PD^yR0B9n|uMgn$$w7Ad=}VlT3Y!DQ?#6)o?cn+~J8q*Yc%5T9K~ODrj-b7JH#m`Ub+%!C zci6VafQ1%!;^>QhI>ssA%RYnQN1E%(k;nzM`a>^)`05U=0EUnzq1E-_FGDrzk?JeB z5uf@g1KAGr7T6-x4jOoW6!fuRIMBI=skZd)wsw+ao>F4e;Yck#$2@1Gr5rc^Rk&jx z62dW;TVY1zw!=}8@xOJ&DP)``JY z`|Q&jeM&wKp{kW}E*<#tFiS80Y(Rcy5aDrRO%cvHQ9J%m1a66J;+9C+GSJ{Vwyebev~QvJe_+EGkNS{ ziGn*{NqpVx6GOd{d(kBC${l$6xW%Jqt=rI%+#n~V(!K3XNvgm zAEk3(tRNlZD4H;3^>qzi5yu8r!9>nA~bJbnT^?ciACWmi|Kb>@}7Qze{tz+FBa z-s8@`;aDkz(`bIRnN0G5JM^6d%;gTjCA!}FOM!xi+g#gIYaL72!wt=dZhcnlXSA)B z!OYrH>FG94RA~TT=$KoID&z&MdM5}yP)Ny+?vlCv2{dH>_tDb}bn^AkO<&97EC+v_ zSkS`y{PWAT^kljx&w~Sxz=H6$;Fw->XRb&PAC8I9aihM~S`lhwtS~lQy2@w^lrr{` zfn`|MOYy$B(`s^GTXHlwTJd=TkaYDIK6 zV)*AG)xa;z*rv8bZ3Rt^hHe?VcD(5GIedWzN2T!>&MHscrgoP%)1I)A+G$J~AKp;5 zzQd!8PpwoPr^TE~#>kW*oU>{kghfu?Fis?YX+fG^d)%@RZFa7SBc*$dQl8;%a$o&* zl+5K$BlP;P=dnEF@>)9nb&ZEM787Vc7iP~ZejbD8mCtEZXK2}XB%Gx$7{9sh*ByY6 zFLl9TD4B4$Vr?Orw%5IV-@Z)C~`gtzEDVqH^m*Uxav5vPt zrwKwoKu19;=vufQrF4f%@tL5O&(C$3OQ+68;xJ&liOiVVVB=lO?SXu(pCOhRC~}xe zL3*N1N&%|nqlm2B=%jyRE|}529;9IzxH8Y*q7^)yk&=z%@?;#fYdKxknei-o+;TtT zx0tiKbjz8TLNYt{==p$L5sVW5xh^$ay&)ndC1}ymhxVcohe@TSn@6Pi?*{bPYVt^( z>~oe~27hMBI$EAfqv}x$fyC3_XVBqddJcJ%zs+TDw7R5718kZ>Fqn|1#$t;)r97v9 z!><;My>Ep1ujs`l&@Y2MsB?Acax$)YFL+d;AF5K@AgtwkQ@wX2i~~~xlk42Em#;a> zWTxnAx$1l`%9o&p@C{eiM!s}UyUZKLz&1PY6?NV8YIhzPx|{JC1ioOnbDC`7gWg8@ z>@O90IKoohtL0n{-yk;6@XP0bZrqxcojehuK_OR_gd={G77r;{P7}KjcPojio21aD z#qW?Tq7{c~(7|*>@?}cZRev<-Xnkq>AxfNEfbDsHdTIU_W2lc(>v`+>EuI^g_+TyC zyKw9XWrBkB9+V^n`mA@tf1sS54F(gcrooU^kATLRmW8U8br;lZ!QNO_#M zyR?itS`S8(p`a>jp{uXpgzkGIhCOcn zDHIbC8k}<%B8E!N>HqSt+UiTrpe?|rAdIybq1GQU0uLZLZP0yx5Giste9H_a$&Ypz zy905pF(h0L^BOv_O9@Ng4#?f&`-Wp)Pu#sg;wpzF{m9Z1SSd+Om;sPb6ON_Dnq%fs zQBsM3s^&VJYniiO^=PC`AqJ?T{qPNUP_}DqI%*LRs7(F?Qd4WU|2?p}`li^N`NX;lUhgI~$dx1T`5WAWs|s#^$P*64h`;eV{ZLtQa*r2pv|Dk+MgpqB;Cdr_!M2 z^VF-=WjSwoQSPirI-NmbFNn1jh5xT3S1W`3X~hnkDVgW^>43AmYBe{)=SjT~Ap!g~s=WTZ|=-`V0p}|Sh@WT|o2e?A1Pu1dzO&)0_ z-}=??&SO_k$6QqEw$eSZ1%wx22Kd?mC{|@Q5k^RjP!6aPo$R&F7j79lH-uU|*f1eL z_eY}n5$+hu{zcu5w&*>3$-?+#x(Rcv+O_Yki@zp(eL-4EtT6s`XatywwpM>kJnQsL z@fG+9=IGWsbCr<3{X9rDsXcSTpK65=wO^uLPl%U!V`>%|#r$kd&=UNTWyq7|xtZKs zFJihsAwu%eP59W1@92jbzU`}NLE^q9J5!^*+pX&dXL-%Nc!-sN6M_UZTWo%aKO7m|Y&GD~=d8DJM&2W9ZQBjg z!-$cbImTq}$&sIr55^3V_o(FO(Is%*O1mk6PToKM}3_VTu_*x0=vvA>_-&GjKZK z$&7KmB>!>HDsFGm2iuHF^_@gKz6pv0@;4_?XbhhD`EA{xAT~d8W~dsjbzth zf8*td`y>?ri8_on`x-Y)SiMZ8d|f^?K`O+MSh-ktNkk zT4Yo*F;lP`*eg8@RXXcleSAVZwkwlz>eq!ZVy@ zjj#$M&>RA+lvCESzMiOA;(8Zni*K4F$MFo(&oCgta&k9>j~ z+)S_$cSiLf>A=qV(d6gCoP5Zczu3_u7^2Z6SGW+<`fM^bc(I=VN6r)Bq^aWrkn}?9 z#E1bn#-SfYyHGOe9nweH7zoNRf!Yb5up<%Hk(V7%m;Eps?ES=!I<)m9r51k+gRpch zFuFY)Sw2O&Qv}+UX?y+*F@2o!I|68tlfcEActzs-wW_t|Jq2d*0rtyQ4NeZPUSmfF z3jH_7TF_S#UI(xq_W(&Ekrg(n3Fpf@6!!b#japR=Z8lGYxA-k3S+}KRm2j0ny_w3C zbS`t7^BmSF-ARHw*IA0)=o5)BV292A8Jim7{ZrEWa3v6Q_CDlI z{kgRw5sf&W?~+S_vK_Ahh10<2gNM>k+9e; zwc0PfxQHG~^;hy5d3!{C#kySp;Sj=2Q>$uc7qXTYQsp8M8Drkvv1(^d^xp( zejH+Q?G}WaPWy=@Sek6pscP?A9X+_Wn9Y9K!t8#0dEw<5dFj(#=)@yk6aLYlLqOZH zuP@6MRFU4R>AVWuc8hP~b{=@Fx5QX^{q8N&7&gL!ggE}S+<tw`#OT@rtFRocj}UpfpLH?DkE`7y!SNU{0Ztweu>ptGU4T zH@Ba_Ca-c0P#bg9X1ABlz|BTuAlN@f&+MWGn+zCis7Y=%N4L5!V$I|h@28p%@`{XL z4v0l*Z@Oiit5iV*;CM#t;4Se6n=bP@Il$$YB7OAyk2vNX-kY*n=5B|L%F#|eST9bc zSAo5`zNm8ew3}$vQU>E6+r-nGG8_<+)x2pM`*n2f23Elvf@phsiRcn^z}HCxO3EEB zeu}2Kl(hIhrvteUypDamnShO3r!XtC%;`o;j1(c}UQJ=9R)iZP z%=%X-By_6LQANOYuM2}%WytbDJX)7+WkphZyjdY=h)oCli1tY)VQUIgr~VaOUu+27 zirA{801-}eN)%H~JY(01q7qB?HDVq+wobFbJ_}*>cH<+|$9AR(ZV-@vj5sR!@}Tlb z83p)4D1aJr8-He~@FZaV6ShUt+Nx#4F;;sI5_B`9j4ZbEr{0+s%Rwfjuc?pUqpwTm z0mqnv`&A0>uH_J(L$ZY>*X!m#G1%mWR@s;BQ9nkytl=~~1L99pwDiyEwM!B8L!%3- zPWhEXz2mtwETqTNMq^Rusw}se)jsDK&Fab~aZGdGeyWu{bfn@sgQlP_NfZ+jyG`20 zPqKLy1zYoxX0*<|!#+{2c1+x-^-^KwFINUdsqa*FmMzw5*I4i#7J;NJaa zTk)un#&%*`^W!j(sCCb-SrSQ~1SE-dfSHZ*7OfcN*jS8{{&&WSMy~0ph-rw{J_Q|ldM{W2yo+E3?J0O22;b2@_2U1`K2oK z_)9oUXl)4;X&0M`z8^jX-KberhmzZz>vWvr8rHFX{SLBgd%u($`dhHKD3&IJO?yJJ z_K8n`u$2B$$CrM@X<*Haxl3t`YA!(n%30Ws^QD25QnZJ>cu_Hdi~mk-_qxmV$Urc< zu!X){;&WtHaizw%_-K)D<-7IqobCkIN3Cmf1(r`cMv--czg)hx4gNFw@(D?qvqp}r ztH4AOsgD#Xkuw63T*>n0_L9%%SRmS&2wbxSSt=MExH-o`x&77@Ic)7nad3viJMz=f z;_`WXn9swC)6*xv+H(mtd=5RrnRZ%c3!9WMktrcG$Ck9&D;l34Bsm=To7W^pM5Xp2 zs6@o#gXr_qr_)~_|FSMqY5y?)r>1QG(?U173-46BP{*0QYkZmqJSp0N=z>Vx>*bv`RT zd(09C<~a7v8n6N-TnHZupuz};VA|Hcwh^ppmgONVJ?!QwyVAWoFwJGpmL*_V0W0=2 zRHsj`ly$)(zwa2p5d~H}HcVpSUW2U+vHAlW(_gx&Y#M%l4JBCs@&@Wp&6X=z=wUrsR!A@YV}5&q8Ds&Zej{b|DPO=?d6zFzSWWwxQ z(v2R?@PI|BQWG{^Fw{Tm%lcE{P1w%!$8+^Q&$7K_{mbn>nz348;qmBbI+e2b@9(z2 zJ|j4p>A@z;jJT;jnhdmkFI?qi@p-{g;qtQIaZ#{)rtKn;eVG}B=+@q{$1lYbhLpw4 z%nB#IptC@jMc#R2O8zq9vUM?lq@39 z2j@I_GS_@7YGnRUqZ5JqSmW~9kmS}3p|eYgwxeUX4yl+CI` zJV+Vmw`Ktv1#e94u8t7T2+`Q>Dr0qL2X?&+-S(0%LitcX+umd044604wIX3=C^?C# zG24f$@PjX^S^tz9VLFLs6vV|;jbr)tKgkU7yv=Mu+l@_x^P>%$U%LFJ z5NnTZK8DuRU~0-WqI#X9jGm=qLb;#5&F&EWP&;Nueh>_&J>Eph-{L;Rld!>8zP(!0 zqeJ;KR2!%3-cYnqZp`gUxF(tMLDn5fcE(0T#Eq8gcTWYg{hlt(C!7br;hzX^Zz9mI z&sq9JKp=70QmVObgwFTz4B44=^ar$)FFopYO@$b@ygtg2r`y%OasUvP`@RA6^E=YV z1l5YobawL9gQ7gKlp8dG+UPd-#>xD9c+%c9S^wfPuB~pOA#ok`Wvt+S0^lu@FFNlU zZfP}FE}+?{U-%eY(q==`2IwajYmM6Lvk_epzg=!)G`n0;^KZ-4>^U0%4P7@bBCtT( z$?^4&;ykZufYoa0o7F+9)7^G1@#^f`LA1YY>*w(Fs?pAn=F@4@0r9tXmysK7Q`vcc z?qkr9XUO9K1y)E&n(OpXcc&-X)dr#pED7CeAenp|rYG0hI+= zSs&AK4r^;|%syxEK4eX`uhZ>bu?)FZjCOryp|3jn=hV_E!b=ICb#aod2I|NyEyUWt zL0dm)ZXlmoNj_C1??ZbE0^03sHkENeB%e(`=Iib--tiDh89yr{#s~~Gs232b`J>-> z5Z&*YB0Nj47P-!PD6W-nkJJDbg)2V(O2z+M|BC7sU84MpMJjwzD3Ct>R_ENWe-acp zAuN4w_QL&U9UxdNL-i6kvzvzk?Y5{1@OiQAo%J@+=UmyP>xm>IU ztX{V69a7gEsmf-H4a4PZUXoroHnrpT$R25S&Wm(Q;CJNl$?hZ(^@G?+U2Kv2X3l2b z;OuiH6id=@(6Lz+m^sHd50s+{P0>-={`m(@I(2WvaeG7<^|U<|yOhMh5dQKj@ja1R98I#QKw|h~v0E+tNO%gyqEJmDCkZ$~3Bxd?)y<>qnMML0 zX?@|3u%Ls@_}%1mM2mrrhBYeWg(l@9o4m7JTLD%~n#oN13IEj68Hh_}=uwb}63OyR zGF)78IJrGmX8FPLzwQs2DcHe#Iu#0sQjrWP_)U8w^yGr*=C$gNk>%8Pr~^_XXPTXH z49UmR3p8alzKDijW7#d&g#4wOEM(LQ&);2E{rH?ZHnQJMAeSvl{;n%$T1HZv@%ztzWH8@o05~u>k}HJin~?gyF?NRC$w=|} zmuhJ?_fwemiKge28j|TKP+$zE!si;gTHpid3v0G&p{v`!Dt5-}_cB{L+P@7c37m6k z-D2nqRBx4QtY2yVO`xTScju_tQFy}~ZwCz6kk)R##^j(;I-ctV=ZO4`;pCM~=11~d zLm5b6KtUhhtJ3>?cD|E+gt?-n2ro}VT9k>-n(^bkH1xVI2Kcg{l6bcU=sRo3;A zwLt3dSg-mxk(mW8FZi~GCW*AVVG~E-S$hXmORDAiAZdWvw{JQxtIH;ef?__rTmC*o zTTZ?3WA8MoKav#uDl}W@!?ba2FO_8juB1p?U$PPEeaL9ud~6l))f}9f^v66hoWu9u zb&`A8i#j2BiKsh1@@kWARy2e3-#-f2EO`NNJ#hG~WZP8FwCQDGvf|}{Al-t`8OOW9 zg!lzP2JH*#-M&R6zH5v46K#HSZ-?fH!e~cY#=SpHx6!ym*~*1**NP9`@xm^YB(Dka zK$^bS-ZoT|CvqzCwFE-+ zbd(Dy>1TdlnAOT)XqWg|Mp+_0sCvA4*nAa63i6EFfW7AkElJQOiK$4w5;V7f_i0Go9fA&P^-q z`#<-4x?^+%z-pZkmhr%eEwjlVHVK?e;(J;(wA_~Vg$DTKAXbXL$m_h@7j9ghrSO=W zET(C(tO5dSdPApX=30-B9^>*MM^(r}!>?|vRKtlPWJOLcVS@Xy;JTq18j!5cZ_{sfrm}4Vn+Y!g_*L>5w@0uUK z{=lA};h^bvyQP7B#mOJuSuT)8s(-Q0lWsPu`*#?S1j?1Fyn;QLIi7d8uor(23aflE z=X)rg$G&GKFYTq6Q>L(r!=b4!5y~G~f?W&mGdDtZe_?j9^7q0&P*|}=Y&&P9%$xFZeLQgo&@mzU8v|u<| z?bhLG=_pEyoEhG~EA**e*E5YBQpon+Xl@0(_}SZy|Nall4CZC%GbfP#A2W^ulc_Oj z@@B#;CQ*GQ*m6ENKfj#}ZfXDo*DpTC1~>Km8b#q@qIfIkToe0W;Y-BpN9TQxM_>y# zv2t$bA-Rg6x9&jy7SOYy?SOpq#US86Gq>&k>1KIVg9&NhO9|dji-eHf;%wx^4);)Y zXzf#_286?l!=18!KP#z-&Yry3wXl!D%ei?A1lzPGD^ekMKMaT8;$$P{BQiK&LhqSe z`W)BVre}AnOFP8g^ntK%Olr@ zPqkR#I#=)`i{&}6_q)$jo521fbFMyxfBu%=uQ!i4{R`ysM{kpNGwHY;zI_P`}N&ig?=gb zK}~@FeEhJBoa%W6<#4T{yTnmr0$v2~PiD&+lNA4*)5&l$m=pSs@*H}l zeAwT{c#-G@U+dczB!XmB^9ahfNzLk^?{K`5jQWGgn7QlC)sCl=$T0`|7JGlM?Fpt- zW(V|srm{ z!%lxU2K%B!v+HTK72sto2_y`K8mzRsrEK@dx;(9zA0Ngz`%ZNP8T3$`&2e{y^gU;a zwE@i#Z6UdM4MX)>>(_=+PfKuxmGxwZqRilMObO(ny#i8}L}P4hyu?)t27^VP+j-3B z)(Ig=FSkuTDo29ie01-fg;cN1^(j;B{ce;Ct_~H<-eyB)hU=fjnnoko#jrWxfByb4 z{88mM%({za4IaZUac!Vk!X?qgEwq)<9@crdAydxdA&;=-tCkVky2zH%A^z_|kMQp! zpDV;SMD?b1&38C;T=X?UrCM$uCvb^1I;%$RH0>E4Mg>fMAp$wGdy%Hb9&bz23oYD| zjz0K?jg9Lf8;weePE1~4om@l>Uy(tE zoAbYYam6102|(6#7ly~;g=%>oI6ZF2>m|EuYP<%2q?MAfvGO*-*!fArSq28e(?KM70C~Z3TbylWfFv!Pe?+{G*)y zW#4^z?GcKwt{EPsp~^%`HO!V9zxdodi1WWx0uQ_wr;Lcy4vbP!#&O(B%o`;;$(i2f z!ZFbp7EO$}RlgX>kCQ$Jxv#TJu5yq8`PT@kD$r|)SP12!^O$nTlqa}2(qi_&5XA>O zh(c8!mO7KT%PgMp4=1ZG^&>hY|Lb{v8VPz7zTt_(b6|@^Y?bpkV~y9cq#*VP;85io zk3R>iF#C3sZ<5UJ%1lL4bP%zo)2=iaxssVX!t%?}nADu(vP_*sER&yC#w?@C%(eau zvre>75VT0|0`%QlA9X(DxNOap4BNa=d$eZHK9(PJMY)gDy`&%ed-V^c-x5LP3x9Rj zb!<@yY#aj7DE$%7^M)o5w?;;(I61L}zt!Yxjzd^Z}nc9&X-j@Jynr$ zhJB~tU_?A(57zBm@4wJ{`VT;TWvZ$0W}5y^UBm9QR3<6ezmd#=7rH0gb()o{|7@W* zNh3vGmx@^LjbjxzY`9-H-Y&w|0>e)g$9~IYRu2G*!)?=}1@QfObo(StI(AU4$I@!k&S2Mj=dc(9BwiUho3TGEAzxz_&hx!^F!m@ zR;5jq;sXB)b6U?j()RsB*G;Uk+x?+mmSm$q+Ut$yUKfWdU}0l-ZFB~ub6UpSygwO# ze=XYi)8puGRhBJb3O_cwL91qf`X2SWxlCrdN zySpb{#o5eDk7YCEqQk$I*~C-j{aO{4hOR_k z8k5*B%Y9D*Kma;l2Vq_&M>#=T3#SG$|81O=J>-$VyzZU0BU1&L>0Fynp{pbPA$SGI ztzPMc+8o>9m@i#>N-wyB{J!@sR#8Ho;g_(Fv=qFo1qvC_9tP-?R0VYeLD+D56_(db z=B3(1B}?q7h93_3rmz~L{4D}H#5)<_wgaERuI1(5ofQY|`{Cv_zT@|+ZJpO)ns;s9 zI5yuaOrT$ZgnVy<&9gd z#U|D)D?XSg`97M71~92JZ-+HOZ#a@Wbst;w;wjVl>b40*DDAeRU9#MC2I6VM84t)Q zQ!ti^kZn1}e!>ItwT^p%CtQU3_sa*C%l$WoUDOw59UJ~NwS;}z%RE;TesguWoH^$! zvTKo>tQY;5xJ)9QJar!|nhDo2ij1N4ZjZfdv*r=8TTfbh7RgnAys>My=%!~*rs8zY zDVP<-fS}v_ZCX>>TdHR|?O0C%GR02#ZhUc5evZo#_P*SIA{CD!u0r8oE3zcUk2#W0 zt-zsYKN94~%9Kou5&k{7ZJTlR9M~3~4{i`}`h)oPcYRW#q@voNEC`#sPjxk_`#tWw zJ0f?yR9~MO@xNj@4>{y$QtyxZbjO zOIG-*KX_+2o5|nxlUJj(yN03~htnr;HuvvbQ*B??%zk$u75zz}tE%SZP4dDziNWto zn-v(sVWYzRf(|fL>Kz;O?H~MB#`dD~calWZDdb4X<@_}JYpw@@2ar2ibj!7}=szwr z;`LKajz3dr$pGr`4x;ZiGBBJZJErDPE{6k;A(5ts2q$E8vuEqAl6RxaoNb$Ky^bJ| zUX6?KU3dZtdqzYd3IbbZzV_?3{Kp0>IU&m{RB^p6YDUVB>vtDfNz^I{|JZ_(kf$%+ zxLcFpOqH)Dqp^BZ!%;zdgr%69av>fn0g%O?jj^c~L8CF4hYWJb^2oB2%~glKl1P+z z4A>901)3LB&QL$UN_}t#nfShX8+NqxtKYV-(;U)>Xl#RXRHJNxR+j%U>T2aXf=e%M z;~k~(6Vc5RS^?Lrky+Qzi46Hxpu0cLH$gCIq5Y`05@HmRL7EVGH}HN#HbB@XgeLd~+M4h0O>y zF9i1Z8_P+{b~L=d(&8FFhg6{$)keX-f(y2Kv_S2DlPFubqQ1mK@`{Az9& z0i`jo5gHOUH5!Wc9RXd^xNWgh12@*7{3F8H`J}Dwmgu6S7-52RIS$qtLCS1UpXxu=IXm1&57u3wmgy-0yaYP^3_xxTI*HSaFBqMT5J$ zyK9TPyB2qMFYW|)cZZ-s0ypP>@AsRp$+Mp%d+jwd@0xjk=ZG-T!i#ea&OfB5FX@U4 z-qFbA;5sWAB=q7E(GXW1WL<%907%dksT#gY{tFbG(9H;kFlk1k5~z|exbAw~#P@7I zB#aL9-R7Ppl&k0X3%f-UJG%!R+Sb^h$@J+bN~!pNm?97W`3WLw+RCLW@*nhz3}$<^ z`8<%B-rU*jG;q2j(>{Jg+wXctsm9Er9?o%mrlbSsnDzeIxP_V{ZZ9MRBFz;jhdWts z)W##Vmfz^!THxl~LkYeI{2W5C-E1<1?v_IQh(Z{!Qv47PWN5^|0!E>=!x(%)*e9VO zR31_rbcwjnNg1Li42hoASln=_*R3}*u`D)|k6Y28(<6u93!~2QmB#boY$Uo}t=0bi zH_-Y2Jr`<+=b;V*dWH{clExQ&36BZXEN(Ck&EN_nS$ip#wavbN+ow(z7ruL4YK(j0 zU8ByUhmd3_fd)lYqqCjI&MCaW30y9Y6$;b+>V*-XGG0RCU2pHUYr^dLH!Wsxs;tD5#RZg@uM!O-+zAwGFNrr1w?$2R_`7iK&K6q8q7>a>Ek-XCF^frzanquoo5*wX4pYCK-0qF1 zXZ5JM zQ%(q^OLP%0)2`M~bw?kMX!uyx70Sv)KsK>B8c|`-w>#}b`vfW!f?-bG5|%a&m`o^1 z<3p#f)cOYxQrAX{WpgFEQQ=ADb=TsmstjjiXL3=cYgI_Ot&ZkO!Ys<=644#prHXuE zOJn^zIbO(uvTTCe+;x~+If24rbsgXL_g(bKB_MfFFDdU7TEVFTLn-H{_;HK)NKc%y zDW?hU@RZ@-J+bOqF}m@c=43k&-2${M3Cv>eP9oppD)8{+yA*Lu5ycbe<}+YzdH;8- zd)s{3o(T^3lRNvy_GWC+*Bz1+E5We?^zAfM7(6tQChC&z@U{>M+L`#1%<*5&@b)(B z`C3VDQv&5Q@`baq{@XDBdlWqX?}+;U{>A?<1bN`i$=MS|q@Mdf>TmUXI1IUZyuGV8 zpaE0~zX@+K=n*k7O_s6uH!NOjITFQ-n7H_&4bs^V-q7a(I$QPZoPpcmuD^x1~ zk8ymd)~J!seNn8n;S#btL@Af4u7&idBT|&BZMJ6HynA~3Tz$OvpZ6O}GP{*(Je73t zgz2-i%h9QpnKo0P8yesMj4HzMz2V2#JHqCI?L?(pMuJ~s22|e$qo>D^>NiG@EH4wR z2H8%El5%Psv9WQ&`kcH%(?gKls`78@S?j!A;(glECLht%u?ne8$Ty39@2KrMA`M0G zB<6UnMF*Frh$h_A)=w{aDyI9Fbb7_@w42QHtS@!{$62iQpToAZ%z{hvo8SG!A`iz> zVr*8M;=UUQ!>iy4c&=HZUYlojxxV`fdlnTJk7qU#kBJb59JuoWU=9(G9xAC=-vxrU zy+H7(*`Y#;&aE@Ok&ldmCmYS*+I=OiV>SQSW9$(Qn{TxDvSxF=?+awKf?|f6sDAi< z9ite&Lqye0rU_2;j`@NeGhJRou$mCz{Af>|-%TP-9`U>8y&wxDQEN8-Q9oDLTL41LdFDgFjp_AU7LVl5NUW@?~v>k6FICT)sHZ{|S`$S3p9s!aR zMoq+ZM4&MEVl=ZF?}Ea=B}Gf*Fati1e( zg;4#Ah;F8xhG1-Bto`NZXRbv)w&L|Ef()^1hLLt>!RqCBh!ko}?Q!v1nNG z@YWATJw9*{>S3!he8&H-8XNbE=$s%v)X)2&DcKB9G+U?56+ScX<^cJA^xI4;c@-&e z*o2poJm&rToX@yelryX6l*m3`+yvvbG#^_?t;?&Djsv9;7c z!^a^VPwyG5?954NQ*a$o64{|AF$a;ZZ`YUd*#MRD#k%J!T0{=7nAD{=>)fy?4KHuBY=rhJGNPl$bNvmw zS9YGAT5jjmxdP8yiVKZ|_)*SSG=e&2ivg(xyOn_hJ@JGU;-S9w#h}F1>GsaA>-K%0 zIDPSKSzhIO<(h?$OIWu(%#M4mGG={?1t;W7ks+F@>LIPkf(@ivgZjP`+i8oq+C5k%0l(pW+Mit3I=p9jCdXuqH=;y;FY47!t zPfiC+rX&7g&eqom#l4hLx4N3D&r;@3cH7K)$&5oKIchcT+upvf76gmrJ4@^xv__n? zX2|ONkJu|w8nVt%QqB3J9@K=3Y1cA#LTSSU$l40C^NTJ07%o!*Xw|g>d-bSigV`BS zH-aNF{1hEF_hPHlOE6Jac$lD9)i(Ji`H`SmGc+pf1Gq!xrS{XN3N-cbQe_J=2)TVN z!a#M?`%B&Ft?f+7P1g*Rp5j}%J(FyAU0?Qn+_tNz%A090l(nZ!aiT*^=bRi%)Vr81 zbYVoUH;QTRE3tc;zMj?na=aA%rQl$8!Q*JTiel4eHj5N{aob|%Mg*oExj_9_`_Xm)xD|7c#3cfFF*}hO7;(K@n8GDjL>;>4$odaTOGWvVm8Dd zF1N>dKA>c`_|xN-bF>@Rt|&yL@bk6C>kY!_1I|rCKW_J{0Eyb%wkg41dLn&>3+bwB zYPw19-Mv}y%w*nlZ%+jSr&Y$sH=P5Ic=3>@L*4lBK?{w5e4ok$Z7 zEA83G;Xh{grJW8l4Q7CFtYE-?1D+ntMq3mz^`Puz%(%ANo&8-CtMcA#P$!8e4{j6^6y(qAPf> zUC7A80@YoSww~#Ek{@S4dt35E%9y)JoUZRTyH=@kH)%HWwEGjck@SGk4ENP-Q|(px zWZ)uc@2{Tsdz@jI3?0y&v16`|&e}mOzr)8SL%HNM%s#Q#-y-5le zfz7IHPFs)#vkO;}V~51%vJQ|NI>?cG2HQ^dW$tIXL-uVV+iDlkg8FIedimyO zy7z1Z{Yk%RUoJ@MT-DGXJ#F$2x=F)Jxi4=Ra%XpeSUHC`8Dc8?#^jXBBDAVQur|+) zbM1dyBavTtWVtM*VUFOzLX?$ur(+ONt^)MQ{bg{gG}QgeY}Zq8LT+!>PWH`_#w~z+ z&k~{X3dxO~GxU_x7Tfu<=?3RHN~?b_7?c~-c-S8TU6k2i`vQU8;`9p(+8nP zw{(6VWS+)fash5}-G&aN75HK?v`UX%=MPv+{`W}{-yb7CHz(y2v_1JJZ)gQf{-U~O z2HJ*Td0*m6bLtehr_sNxburRilzqfFn%mM6zM?ode(y@cEjAam+wf#f3~~{0_j-1; zm{3O?Uja7>Wf9cV;SbICp^0_(qENSpw@Z#!4Z4Zv-j<3UFjsG=OMZXv@ zAPa1lXwI8&F%lhk;qa)}r2kSfOA21!-KP)NIAnp?z^w5}K=@N742P7?%3}-GD4wH@ zeM$s%yYyau)_p*1x%_5+qZzYL%UF-3RCNQh^#f*nAG;;;sRLR_54X0KB#AM62hZ-K zmIw=X`lstPv?e1ObDMeHNuL7Ex4-gu5hvqmivnF}3-0HPNI$IaUd^;FIn9gv*^#gl z`hn~lkkl4q4#uWKXrK-bwy!L|Ug?+|yn0Xf-cs7c_ud6B!+?o zLzn*%$!Ihk3ng@=GB@t$gB_j5`9NVZ#8X z-4zhj)v-5`jEun?s`oHcC(U~&ojsFOgfeZk$1I()mM3;9wKN}+g-#-=SO}E3klCAz zm*Y3qd>!4VvN_1yn*g4VfGI^c<>C{MArEt8d2QRl@OT5^g<>0PholJ7zqKKg1dp5S z1{dBQT@eUY^2KbdR!kU{7wYkio8GcO)A;B!S85Z0=uC{&M!Gz{n< zOO0J5T7T*paExG(B4P{J7^%}!W44=dQ!ZVNf)`mgr|GhMQJh8`T^(R^c$d+x)e0~Dh4 zjh#M3KpqGxpig~Vx+)#=Jb?I&e#P$VBepc$IT zVxm}gBHJkveNDBl{O#geuMZnVt(hGZwD{wgtq(!{XM>Edo5Dr(VERgRh1^ItftX z)V3o>5TNI)5|yx8c+Ru|8r$eBRjI}Sprq9;SzlYz%#_WrZ6BY8@LTeh=S#EH`S5lf zvBz{Z3X*#r$Rw7_OO7og^Dl%BRcLZ$Alwws<{pZ+MIIsbWGow%i9dUa(NG~O8?19I zFlda;#;=zuw*3?3j>!z62;3V3p7#!h zYlE6fEXK=h*SQNApv35x#$`$y$xUjHvWBzX3!G9vc8muQ3=OgQH2S}UuRllKOgjXG zMS@+PL|!mvOU)qzo>i(Je%hvYMNt^F=pHOP2Tnaw=6gSe7kumht-iRFw(k7{Sc-8x z@sJwD84v9t9k|f(a>vc5P&t4ni$w)Lf{oP!{|0UF2o-=h>L?!;O#LEBb)it`&CyZJ z+yyMP{#pDp3C>7XeTaK9B}QvP`uv!ituBwh+h~KRsQV6{({CfUGw&+}?s%_{I?N|r zKK8tvBK)*ko%H`kyT3+bykH9iKiQo|mN&M~i}NgUpyfTIz_IiTX!-jB6J_^CCqc)z zZ~FgGsIuqVL{QvXf9~beWbJmsB#)LYp6uYFPMVr^>0$AdSsqzd;9hpl`!*&g(|7#O z^`cN?QWme9Vrl$mzUP0-_DCm!%ge={nV9c)iQQ$}#1Gf-Xfh9YoA{T0RKJKl?#($! zW#k>HYN53%tV7Gj9K`){jZPj7BP}zsxnhXj*D`xUqV8+$FGA4tz6{S0gnlOvAThGOF6l2xXE}brc5Ka zD!80U`r>nBKyy~FI|l3-{Z<1^%f)9ZN7WYqIU-onpYgJv9UbIxZjm(k-<9eEbwmyk*)c43%piFD3vfeP7kT-#8u{3M#I-+oONCbLmLN z_e;r#&awL3!IR1uL}P=xkPkkFm8dM)*`0%$*_YKh1y~VAUq(kL5&~C-W{NyNr8kw0 zHkZfS+iH02|05UnO|Z^fo22daB~VtW%bxnMH<9NU`s9GLgO2v=56p1fTR8mzcr(^- znK#5|tm__jaGd4P&7cB&#&VAq#XiBY=!1*SxE-|Up%&f!tC<5?bdwyJ6N0xB+f>8^BO7L^d)&7lL5)*AHlw@*Ci z`2}|h^Ukd2NIWz2Sf{EeWiT_RPH1a!CY3%ADinLWQoES<>ULi%j}wdyF7qzq!Cjs2 zC?re0#xZod^X3X{_P*3%0b$*vz?od&H)`|@hU}7(kA^$v{W_X*tBsFb4K43=F^iAq z9cc7mOQH8JLo+tLKRQIBXH92mo4|nn4M01~y+2@Hk?){fX)%qxg`(}q+(z|Kr}zHT zkonU-i(=t@d_CK(rKRCZq!A@J_FdVIx+r`=T#`Ti@f@S^=XzTz?7javy)$dQaD*3k6+oCGjOK48L@sjUUZL zq$Ot**m1-^C?a5{&f(>2fa)kW*7#de{~ZgEG@6-ivtv?x%>KNy<4vJ||Ea(4NC-~5 zJ?1x|U3X*JDi!#}oMgGRpYzV|=5jG_dKIwwk^eVfk-~mTBm9e0Z>`C{?nHMVDDQ@{ z>2vVk(ONu6vU-OVtvo16rnBMrinE(#{D$zOPIXH%h2!{>w1L$17KAR*H?d_Di5-Mh zi53U(Yf}D|^-{X^L27rdR8RR7{0LODg&6x>icEU*{uXI8mH!qHQ*iv3Q%uUaI;xu| zpL67WR@G;m6=!{&2Va@!lF{GiX2*QaDC|D0)3tumlZD_h{_45Zolf)V2UdaSHb%}3 zaFE?hf$$9~OP#EufDMI-gQ%p2Z=QRpAsYTtN>e#vf>cJ44mD)6LB*V=8#wm7}^=eQe^&P~J4d6;FTBU5k z%$o@62F$uK7Ah`Rx2T&??IN<9{9Tk~UWK_EUmHtpnreQNGybC&Q-@|X9bPz6m~;X= z=Jld~1^H3_y)1Mv<9v)`ER2%XVw~NH_+9Wb|4Ul3?L1Pg`6J2GqMV%ePRzSkL>d-6 z92_w?4+$Q$W9a6h{IGqWj*GkJLKSVuw==#W+$D>iqdhl$YV0N~BR;Y5=*@V4E*t&w zYO`U!Do)_PYNKxm+p8deBCpGJ53SgCH4xlH=C4W^pz+I=J_wqeWqlfF zP)@U?i;lDQK@~^fG;{LPyWYPT+Hpb}KEMeQNga8Z7bIW(qvMU+5){u5uJyV5aR#Q) zjWr2a4vEFaw&2@BmT3M&$wH0}h(S{J=_c(%*P&j|23vHrv(O22O58D3JDFcnzGG-E z)#<=uP`fl#39w|-^v!lgBQ3!0hha38WJXSM$shq#s@vz#4#VoE_==Mr=sDucW zNw~=2M#%DfJ1*D(IP8xbbvPb=&5z*fXrT@qVjLV>wIA{@G1ayl!m`8h(1YrC{IFKW z=O9bfW%+(2=H8Bmk__cCJQI$D&9N1%S-F_o;&LD>=}IYJ8mNHOnaJ*{$~^g_uT?l( zW}>4b`;YbmmXrQWz%e5QYi?LQ21ABQPxk0PqFa!(1#Z4{cW_Hyp3YUXbNHKQ5a{ir zQ-jN;WRI6^Z+nzR3*A~hsTd4#R{V9mc$2rz zi*}C2vo%Qu2Sq;v2irsZ{>erTlKbFgO^NAnedhkWZ4>{2n4`j#i~~8W)JcV-9VdWU zLCZ~@GCMA{MRd^lBDHI2RH(`G!diIj;?c!GUl0V;v zr@oooPU1vvj)#-7rHX}YhULR&fZvvfWu2>gv?@Nunm@KKf5odb!eGx2PP>DjDz(MJ zzf2GQL@?2Zi;IE?ciNpsy!I#G$3$*UV_o5=oe`zER9tPw|4gef?qu*Xxe~lsXG;zz zumqMj6AP1L+hV^X14gf^weA8!n|p*3Khs4}#G2YzIqJ_csxqoe+<^#pNr-L)CpCGA z4H<~)W}4*W?$6f8T8`C@mdhEVOYm<=H&V}PMNh|#Zx=C1zVrqSxe?4alB$%sP*JK- z%Ru7F@GpsVsdiAr$48Mi3Ppj-xT#8UpRyJtf~kk;|(zmfhkL5U$A*)fRfp;$=EQlOwMp$>2l&h&C76;#$>(4F!yr zRrV)*4WPs9xWwxR@+$qSsh=wEFxA}oqnQ;}HoCf) zLR|k|4bP0)FrhrNifkUEvYTH{&Ch((-$G(F7ctgolmg-Ja%z z!r#QkbU^47@5dQ07*YC)3IEbS>7JMWF19@Oz)oIu6(34RiO-EvouYQk4{6Pzu2xF3 z2nsE?o!r}JaD3in@|2V5$B860G>49`w^lVGi2b=^3TyEXPx#{qViK(E@{I_kJL31r zx+|Sgm@4H+pka1l#F(Rl|9Ue=LJ!7(=XDYKMW%H;*5h+Bjy-fY;Q}U?T|fXiA~;9T zZ0e8DTDw~ewQTxSg$C=+&d$+tJrE8_#L;@bbJ(XsW6|~W8cRL))JK~EA?gW?Ocdju z#bIzc+y}GWb!U5bpo2glM!l|aIGU?CYq3H@DdU#gVdn!J^0OG3ym?*ESrU^d_L?Hd zbd2hIXyDct<@P0Ps9*3OBnJqD?SeC<@sy*^TG_0FxR!DxEx`;JWAJd_hky5L7GoBo zi(Xq+iEe`{4a+y>c3Iw}@LHnC9y$*6PWy=JA$7sh_>ub_o33h5q1u_zaK~>I3-ki> z>rg*UBAPec4-{IPP)qxEeA~Z5ykgxP(~J>(g_PNrll@{cbL|@*>CNp*tJP#{wpzx$ zCuu3$&^sU)vw32?AyyJIsH>5?LlQ`s`O5I*+!ysmGFOj3Hf$;w z-iBFgvSnPhPx!P>KE3_&(vpa)HV~8?2|GFj>spT|LZMW|XIb6B90SmB@^^aF zJxd6bOb17RNQ8$!xu-_aAI(Ps-1y0_XB1Bw0i~v4Y`dCX6e&w5zCkyy9`7oQl~}j` zYm(gQ4^ytz&7#++i=~i2=W)BJAiy&kik>&6#y+eLbwBE=h1>4sG?A>_90MnymV1W1 zXVf-X&mUfz)+TELr}|UY?RPH+a~zc*=z)-=2<$aqRwJw8ujHzs^^?DrF?$NCR~*K> z@h!4RfE*ya1B`D{_0|9-vk8m%YOBFeuc#%SQnK!QtD#7%jgB0i$nS5URQ4J^B~3h| zDmA8inG*OJO*!i>Vge^dOjN#5H!yRFJ+S0sV^aNZN&#E}SPhMZSB23}xW$hETiED? zZ=pv>jED37*CubB)JG8#IY#_mw=qU}7CrI2ir>zsH&i2)%yupdKeuJqlu_V^{k^D1$MEet#x54+b1ptU?VBWJTfxgVfpzGEaN`^NlkgsZ^45PlBmqy0 z?WNE-COww2VurDYAtpr*6}~cF)pGG;LyW1816|*Zjj?^ZH?JDjCSOU0lQQCyp zpjK^ofDU6! z8R#cPVdi?#n^^rp%t^WEXW5uGkYT}#+R+$``p_!@h8G3p=j~(Avf!{G9Lxh{Y(1>= zrSCzEO+z@A$`ef-cdMYvj1pn-Is}`S{B6z0!$Cxd-|mUUFIO&WOZ-raNZ+Ynm)q%}+E%oLQY_*9= zLqjkp#ru4JKD(wO9!)Iid^_f2b0-eEjd6=B+xiDrj#0Mx*wprnm{QFetr}?Daf}Eg zcspU?!~pNTP7*W_)_ue<`VtH`5&m98c!#Q*zkVMu_mfoYCXaTQ=Y&i|0A2qAnAD=< zhyLEOh=S*$`=O_dnBVhOe>|1BD)ueVv7La+{%c?GCoctbu|d1>Qt5Ss0q)Ln&R{M& zY7B~iGUKhQ5W)Id5EVzvsZ{m6+ILil?X($+p7KqeXOp;bS$tZ?B0&G)G4)Y!u~7Bc zF4fDroR61BPObtxJUmH%0>gBezTDtC925+2i;kqDp;J7pfgPHn^W61>c=8uCskl}N zmE-yE$rt>rDs{1%cMNhQM{w-om_0@d)YAi%{|0I_T7SJC-qhF^HD((I`Op{YUtR4j zv>Bjrr-cNGoJtlKQQY2I^F(8qtyc4gMMq*eo+b)KFyYpHE9x_N(+X|r&4_ila|nN; zQH+DQk(BYB7%3ehWnNMj$XaE&G+7&lwr&q<1#9NX@#DQw5>zLYeSUmKr;5=dX5Kia z$>0ebaRTeR6vWlkiz=V?rFdK_RgQi&)m;(Vxl@~*ycEAAa#0uj8&Po?wY|2iGHxSJ z@J5zlo;38g|0zk5MJC#5%%Kx&t%M^BnFN(NSAnw^Rn+0cgIzV+rhg7JdR+rSn}NL` z6unwmX#I_dWB(TC^g?{^_7cp|o~-oaI%B#{0HhhU6S4MCqPZ)fngfu4(dRH9-^y(? z3j+D3F#HIxUnk`44!&4ePv-^QleMNB6YzUBhE^{+d zUs1|nd|vmF@cD7beu|!D6@A!9i^c^%ZzTa$%HCIB5sK^msbQ{l^T3{_W{NaJ^!LYnV1w1{Fa0-NYu&lP^fbY(8w!b1 zEOX$+U0CDhuWuom2M#j@l2x&r;=-AWBkoy`V%&}G7@o+SQcFq847A;i`0Yf2Qx39U zk#K$JFy@iV5}$(8ic=IoDM87rOjj-gCmR z5o}rl^j~df@x&3@7!e>CN@FD1eWwnhpYx$BgM7>raIQhpDRO=@b0kC zH%!XddpD9dMDF>ow|3LTM7A%NWCiP-2(qh<@^SeYi00}P)9~+JA@P7r~&E5MTaw?Nlp6zT4_Ia2*LV)?)qnbZ7UuRf?m{qRcPS#+c}B73>Ae}GrAO-I&}%g`O`z&py%`%Oi0 z?`IT+K;*D{=2U_KD zgfW=)r%*1kS10orQnY_FL7+R9gA*&eJkK}o&fa8=-x>~rPl>Ch%j{KL*S*G{!e(2q zlM_9>-mF&|PWsNdkfu)}+VJda42BokY*xd-g3pnzn-5z@vWtbB{dKt_+@GIJtDAPo zvoT?#W*?_z%vZxXa(v_tC$o;`YO#5%1RZsrFYT8MJxJq1@3;*KI9h-)+Pk~eB3j>_ zJIjAOxK4YG3#&$+_w@`-epPuzcpqX9O;ajKuri&hRs!;PFJzC5#qc0?FR`LM+MR?7QiMHiGRnj7ySMCwA3pdZO(CJv1xYM(=bosZ^zn{I;1Y8%`Zs{5-K zQWCMTvS>vt37yY`mlh_J&+m{?J=qH-a)Q`M=duwtIrl?eooY-*e^t{__HgP1U-3yQqLC6DEp7AjsM(B`5FkBT-;285I*!if zJun?j#5@+c(sdnOQ(>Sqt$w%aAvZ`^o)$mJ=v0DJKJUYU*Ac*`R&;F zt=4hH`C6HgNnE>QfoJo>XlIc@U+~Jq&tkbO#~_|u?*X+6^&YRw&f-?mvgXw=13ZEp ze)Jv7E1e5OJ!AVDM>wG|J1&Y!@m_ zHk?5LDH2pmekhX9-+r-Q>%kBcji1nquUMfkBE=|j!t^7cN2~6LhcR%GUphUsGNsMD zbrtEwu-3RJIQn_TlB;zYIsY^=^?v=0TO|-ps7j3|kWe*C1)}d!Q=8c;=RezIrkG|- zLSg=(2X}q}iR%_q`+V~jy~yF5QuO)ppjXr4#cj*JB6K-}tjv(8+FCZ{uqYW$9Y*!K z<~SOWIdm^GKdgNlz{_|4Q+lufIdP&VA>*N@82l5Zex=Ee)W+9$awSZ!tx9AwMv(Gh z?z~|ba|};K(V>^m|NUv3lZB~O@N7IeT^HH>niHE#XYSj5-?ev*DJO!fugDm}zZEZq zNRqeUw3SjEPCD3d;sS^!#SJ%uk!f2{8XBwWVF?-NG5T^J7AN$j!>2?2#)MW*b!GH# z45LzoC6F2IVVd%gbQDML?*S@m)@iq(x@;AX1hzUsa^LrwX1I(fy6-CZ6=x;YeDQuQ0&l>NL=hB!^ znkbxchwODPy7Rnqc}R907{R9+2mG5bAI_S~tw@zHO-NYJuWL+l!! zYL3F)5G3O%!*HuihjBC;Eei<{!psIIvNz72ENEhGnhG?+*jAz!NEJOYiqI&l*3>8k zSyMthw3N87-eE5WUBlF59o7W7PWqr+oG3t|5x|BvdBV*QKD$=r0P`_2eQ=SW1&EGhxZ z<;Uy|-I;8opE@l9Ss6(~ebfgX(=u1Ng^}u>9~w;pxP1tMePNjST^T}IqIO%Tmg2NH(3X+X$oHtL-HFa<1 zyQg`;pOk70&r^QS`LfY3#|`Q8XXE$t^(D)W$*z}+fJ1}QwVT_&lsxxZg+ZPCM-a*Q z%<*2_2~#GNA~wVOrrH7@72HkL#Q+Q4+z9#XAKuQj;};L?03Yp$T&)Wl#Gstd33S53 z&u`9w!%Dp7YUQNt0@i;UaC+PkK43X`0QH)y!pF?KtCJQtxv)L>+)5fritqujjp9=emqk{DLO_gU|GZSm1r9%{RM?;iL zb&{eUvTK~&jTk1XpBZ-st1#y(rz0$Oy9y7A1uZP-&(|ZK=B?!O6`3vuKk{pD=I}I9 zPA=J%t~v-{HZRoa-ys*>W&Le%>Hh9^LNgiEMVth0jwl$T_v7auNo1#^bq2e88)1AR zYRL1+k0$Q+P1J3)VlkTLJAs=;yskQ4*4KM4>=_ZVK@&;bvSY~+#%(mx_BEedL=wVv zf=v6C5ds?Pl*`p3*oQD`OviM^KLPSwbKHbNigN_h1~_i7uPOhSD>!2S@`JP1MKWev zpDD$?XCtfq_{hm>S0p?Fh9(bgf}>K~H%F(VoYXn(uuvz(ElO$Us#DU=y{i9C$g-5c zWGZjHTIqLRC;1;rbt*p~lA!{d00x&;=fq3RK~^#6l+y^T7ehCZn#(Z_uNyN}v)2>; z(`#uQVOv~+9i5q{gl|B!qjQH$0msbuNa!^WO9VDH))+be+%|J4)GC9zwA}rvgF0$g zom1zr{3eMCTM4gje|BugW&Ls?Bo4FF@S6cl$Jj3 zss+BVgdrt=Bn5Q!W7wq2H(FRten4K9U5Yya1U4yWoT>*r#p;GS_KNExf&}BKWuH(m z)#P9QRx@em!Bz4Yy+7jp*wOFbcMO=jVmTl*dS^MB$!Gkak`?X8;iK~X6>B@cfz^N= zOPK~2+0n9J89g$uOV!O* zu#2uuqSg$*4@PX`%5DdD9;}{F zC3Aph^ogvhU#EBroy(bYUvDWDJ8D3%OtIwb2^W1gOn34V=LYVYF&x#050fCt6+UJ& z9^dIHNYkP`+yB;MO6K@{0NQhX{1=U6A!T`U&vd-0-MGH$@TqZk&Er0kA>+dSc1f}> zk@lkPltIYu08*IMaD30M!{av?YUObxPbWy$Y=@b92XiI;5cH=>Il7jsWXXcQy=mgG z_b8eeWnr6a!Nhw{DO)hcbfV%nAN^|j2zGk{RZ#kTJ@$T5a&0~5OuaI(pk2pco~|CI zW*0}+iVKC+68Rv&{pU;l*LPz+eS6F{eohP~?d<5?#7QGZohhrFa`xYhgvtt=3>=m| ze!_hs^bKJ0?dZ>BcvgSAvF~6|&0g=8ok7`Tb-fz$e%v>Gx=b4i1r#gs8RAOc15B2J zDdq^d(tqoW?cg|NfS)c*{xXKKy7B~x0P9BUIczMw|Aszp&Qy9TX*xeezoW$>W#>oC zN@C7xyD?duY&c>GI)N3(_ha>+FDZ||x=>G-7hTt!$RmEb7^|pu{BC-neQ#w8Y%j)sC-6qx`oN!MlcuR$;MX`0>rG zufa4&bF+&A;%$GZpH?+}frp!e*xk_+opB;60t%$$tUfo7qxNcxevqw1H~;z{WI&KKOtDkjss+9&ej)Xwp&JRrmxlq6zD>_5B9s@@dHv;Uzg zkJsp=QYCsVA#iA%33pWS$O;Aiz`VwDEY*|AJSAcQRzM6XJ6agQO_9n9il+hUi{*HOH*!ZAY z!Tlp~K<*%O@)Hf;gh2mb|Mk}Pd%3fxBw8iY&%{sx?u1l_qbTE%GsnwEhL2=U?gfA3 zUK=7a+T&TM$_ztOqIFm}Qzz5`AGu|cV(78v6DvON*B4>sRiy}hO553oA4cZGVYXg4o=z|{t8W{)GMvK{6o?PEmB}i|MMTY7 z!3XK%`ecM*bW4kty_DP`j?;!KayX$7Q10q2f77Gv&7`N`M~pIAYnk>|<_cc=&SY>; zrml2A{v#qG-ugG@T07)(_gPgE>&)KQAf3?avb9AWpyOQO**@({&9_fE$-lHOarTbd z6hsG;lU9;@G;cM^ZLl?cuW2VV8;YH){>k&6k>}|nQPpvv#&mrB7=rOS8W3qRoH-sY z;uCt_aZ70JPAx0(3?{shTt)ZZDEs%M&|6uQ>yuyV0K7pyZMB9RNKxQ)BjrE;xhg#k zTVb2)T_<+o>ECYw-V5JsB%6G`=5rJu+^leiMkKxLmube|4OrV9G25CzWB0&}Sk~~_ zbR9E#?XU{nX0g1@M&gZczA>3CkjuZTC4yq6^YkrGFj6>F{HsBeUefNR#Uc96?n}v9 z3(qU!DV_1gC(c*&7N5aQ7A&54&O3sf)l&N6F<3v;bP~gtdSQ5|4;{Oe*_xC>jWb`P z6E^~eucpn0E&fl4Q4W497|F& zMGSr=rsO|u4_FrkRv?6Gm~+lmAi;aZ*_+~j7A8*r-oI9A#6R45XNQ%15)(Ra^B{i4WpP{w_Z zy}r6v$Ld7itCLkP5yKymY^?@!_TL1>9B>n3-7;|Z&kNYPMT5Y5qGBJBUxQ~AXy3Av z*rYFKgf#wPAX_pMUGJ{M|s6FT46S|4Wr6c3mGv-8{ zTJA&8>=*fp+i6`CRnoCzRwoOXkc(xEt`z1NVtP!=$O`woxx5paQOX27KGS%TjDedr zBp*x0P?DKm(_|#|+W0Dt(xZY81qN!1W7y)ozDVc9_3jF%PE#Vl!cE9e>v$WcN3HU; zYFQFB{6YsYrD90_02K?2VeXOk)XN|;tQwD> z?IAON98ckIH}g%A160gCg0>5PAZ*hhBJ+*mo2Ge)h>CrqKJ>5h8CO2SckkY1>(;H> zt9>{AeNZ1?wrkh!f9*5wh8u4DJy3k^o!j)sjW@#|CF7^}Y$i>Ks-$vp%dqQvI1!N= zpRh>YE0uvm`yNuE(tDiUFr9qg?f05F)%D%Ef1NKL(S@bKmRPPgD^`vaIVw_*Mj^OYZ?pkbAZqkhG`XF{3 z5Ym+!u7{_jSh`5&|GJfEdvfYDt534HOB}iGNtxnV2)S^KJH9z7mMMU<`_{4ld=SYB zmZV9kLfkvCm8a<|@qVh8v%iVS`14z*xe}9(5_x^uzx6C7E0^H@@x55H79!&03DQ<7 zPl{(ZSh#XC@je-7(zG^DPi*6fmZm%t5!YBWV>uz7smW2i8a0Zi=Gy)ZY(0CAlo`v= zsAhgd;Vhc&ic?JDlt|6#y<13Iq6#VP_nEhBCnc&kBzFo`sSYmg*oarj8e~btq2iz2 zg`jMk_Dbg7quzKNg9O(+; z7w^S~)rw+za-Bu1w_x?nNaH58Fa@7r^2XbI(xw52%PKFa%Y?c(s; z$2k2wEoBR;8GRwbo7WRiqAt0TAm!bFPpKLtd~bSs$4-)!E>8weJuyM2S+eCQ4pTY` z=L+QH$-6Y^T!&pV=JP;p3TCxnOp}jRwaaQBm@2={{gVI1h-e|_I;`<=B zHTCh{-!pUQ#$OFpf3N#;yWxf#?=IYA{9lYeO2*%Hyh6s`Q6whgZn*Kb@lWi)>4qC_ zxZ%d%i?>O}Urr~w@sHx)GU)yrb2^@g9oWlp~7$Og!WHE`O@CMe_!*%R4WR&Ujw`GwxFJEPfyQ3 zG>h$?8F#}CH{AGl;%&~1yUF-l#+#7wB1MX5+Zn4$ewWFkY9p#Vw{PFpTtMDM!$Hl8 zt4$)5Y{`-(bCYp5-WpWDnIS_4{QUg1_U0zzZn)uw8~^{pO~(JlcoQ^*he6#&nI&$52zI!;^gTig$O zSzBs*?aMbVz0k>{o9DRm+;vlY7*{Xd-;8PHSbICqXT@>{6}7_Ve*fAi=3iO zxfVjQg1LM9I>W#3!16QUu4{?$jDd|>axL-qo^+*ocTsM7~_Oe{?2a4O-_q z`}4T7Z7fAfWyjT8%LKcXW8soU)WtPvY_Q^&{r?F=qTYfM2#;k{A)p9@n2<6MiLJ?y>6)gr3>LwrzWu zFuX7GHo5BF@|ama_G0{)pP4g#iqV^`%0N^w?gEvr)_#Hj`|nOQLrqX3Cz_E0&Ty zCnV4C6GZ3!l%n_6@>s6yS$~wejcbdz5t#H24lMnZO>2IkSFcfAb=fqJ&a7wXuyHKh za}|GI=N6#5rA>_$lnfmyl;qZCfBebD;X zkTac5(v|#`3?|p__hnJxy8jaA&%hyNQf2$=%JtVHk^Z$7rsPy|zioM)d8qm^zV*D^ zaO0naH1j_PonEi4>8$10^@1S3S=k#4C9v`u*{geji4&7hWE}_qtha zJN;MY_CI4v?_X#!^DA1Ei{R(giU0~x(>iM%W-lME>>Nw~&3Zca{G9xu>-cQ;QkD$v zkHz+cA3C?^r&Dlc&1{w@Fp{?gA%HQDZ?o>eDUKf6%b0~{C|x!u>qqotw>F9Ul+nGX z5P}!aL+*3al7gni)AD)a?gUx9HNt&o{}Se{Kh2^p%~)?LN~^+2m^EP|HZNa}AK6RR zkJ=G;WI8jBKjXyIu569VM#DNaxcbWg)`wU)y>KAIb{hHU!}naY=p13p=`)-=*y-M|3&t{aD46U#!`2<+^x`3m*zHN}k5cn}-4?`G z`IhdjK48%gpK&qx0#)11B2U8>Bt5y6!?*73ye^7|L znRAghe?ii?wt|FliQ(SQR!mFe20 z2@ihxhF?zHU|`FRP+iK{yae;UZNn*DZVF`2O3C~$cR4krD#o{82|32f=&whTznk3i z_%Yro0<`O1$$f|ob-Idp=+oe9G`^r8N9KA94 zjGGv(`TSE>UWF4Y=d*ZLKPr#DO1(x^xwK$D ziRrkPUjQ?^*PvRp$}C*CP+M#KpMe7}Y4rC(4II92;MgNQRv|5aw5L*J-a~$WFGO}3 z4<_&SAVh5P-ycB~5!A8zm?xia@?`Bpoyh9C^uK^2;s%?6A2xXM^$rhCKQ%J?pqV(4 z<@faGZPU|lmzgk$@E3@n!6+p6>=h4Y-_qeF$L}7T`d@ZP^uO7Y4WUl`D^h;@iTrC8 zBk)fVWl7g4L|eNz@o@r#h)W(1pX=Fk(Sx~n^rD~tDIW)(lEzm?hg@L>92`;{D?bu?h+LI zkkHVFTAp`;f{C-~{_w!_TQHhExV~)~lUAMo4MMKNA*AMcc+B5J$fGW?7A>Vr=Wlqja0(mGKA=JM zQm(t+7IavmmEZ1pPM$tTmBA}$mL(}xy(gYpb1>uQ?<mMTQU0Qq0ComWj{N|TcO*^;?Z zbHQ?h0bLq%r_fhSX_5s?Y`iM628aCB84|i2o3>1p*mDrFhdv`#5xiw6{pN3A?d1O4 zaH>Q@VC7ciJiCEetDaJ)T2hMUF2uogb9f$~k(@q(n8c`4Z7fap0yJw-gaS1_B<#Xn zuI$u58q;S`VAu#_5xHDbcJUzGBoilrn}t3*dwIVcF6(RPEe@n~Q&8=jBjZ zf7y%1?>}PH z+%d84v5-2GB2enefwjP+bVxmx|%$%rLX3BV#AEgedu6% zomlFpv1_B2iu;1dsXScyB!#>9nq9p0jkgfb@F`zl__rrL>@=zrU3b*~sXV#{uq1$7GUt64xXI)A(YLRwO})yQ^n13aPugb1gGx|HP!>-KbQf1M_~F%bfYkco40Z zxO!JQMrX$&c^ajsH)>%fc>s0JV@)0{NsZ7dBI3;3AcW9F$i+SEK6M`txyPvF*M1_G z$&2S#meH!~93e{n+ABrHAhdf;fBjU(@n5Htp~a6(@7J5DLJ(?(Y-R70NQ@4<5K9~J zaTZdf@ZshKrvuBQD_5{4%|g`zITxorR0)&8Zh#p9JaH{IH| zqEqKCG$@*03-q%#c*of|bS+O9A8)}Xm6s)RX7W|2NB_b7Y1yzl^-5(RIwt0SbQ7@K zEJRyPG_RGLVdIwYQMD?>L`4fRvtyNfO&PKgc<(5eC2riqJ*+x=TO0i1Ey`8Ghm_IR zIIE>(7qvEOlX4_%vShIek(IcX_;@*1 zx7*~p9lP~q9HldTl9XhRzs*6Vo(Jc-7y4WVu$PF73a5D8&a`gbhMto)lHue;_C1Dd z{*hd|;dE#@cjg|cb7UoH#3e3hA@QOIJDJiNiHVKFnz$S>S7}_S8UAJaFj@Ksg&ZaF zbLIG9?fB~1yQD3cO*>YDqg9hv4pV->ii0~D+Pe=;J}gM7dhN*e%4BmM3R@P^=VDf> z_(J9qCE54u7|g}n%Qexjl+~fqlXf7gQH9s^nJjlso*mh*rEuuTQRP)ds^n&_U%ab@ z1zo(1E`4rlW$~luqq<`IW(Znz3Ow2fD;*rFOd1he3aWl(r7_^yBZ@ZrPXU$BJdk#L)Yox{r zhjamYmY#8@xA?lWQ@Q5sb%X?ojF;{jIsVwduV+mh4Kj+6CF6%Q!gF_w+=&r+Cffd2_a>Y+Fp?(RtW3d3r50(0PeUb_){0ga5 zL{G==%Vs8tu0$1@J~z4a`O|q5k}Tem!G_C{?+G(&gADTgiY{XG%sORe?s+3N(Yc!Q zdGN@{R57MDhKh0V%1|OiS%~MEn<9s#aVkv8Dfu3|C5Ez;X|l+6GD6Kzzm!c8VV%WU z7ZcAKu}FHB7y}38o;eaWM`V-XQgjVrPmD~Ed{;?3(QCvs0m{gL)2@6^i=pJH%6row zeT|+uqW`C&M-^XewB9fvk>xMZC28oTE^Shl1)_5$vxn&K^i3nTq+e5Q z>C9~-XQYiSmomCpsYvnLljJ;11=* z+O^BWVdK=1z3kevj|(?%aN|*!bj*ren|XHsGC|K{H9~HQg<>tcGI7!r`gN;GvJB;! zIB^oA2YyesK=r!Y%BjP<*|YyD27g~1u}`=e6w1vLyV-T{6fr`auOHpXo+D?l8ocBo zbr5{xHqp-?uyeIek)+*+clMZ5^8S zJVd|QVvrq)0lX}Ga|IyGw4VZEa@JwC0%lu>o~QQ~~_Wf$(`=t;AbkStR! zAqql9OV#1}njeMWC4AUwAXDC)_`EU>c#=JLMll%u$&xXU4_fr6y6tCbw(Y^$XipqM zEdA5wBwZ32DFtbB*A1!3lFA3~)Hzo&-i7F%d81C1Y|M zRkB&gB8+X|Nh9f#ImnpA&W9Ooct#o+d%-}BJQl+5o7f`keBDtYvnCtW(pz~Np-*_x zp^-9WOTCvy($8)o>aLKgU@-t(B+)G6#1SE`QzX5@nZ=mBVB)0MczTiXfRL|KitGs) zd=g}0-UFzU-O8pD9$XR!x#z_oDK`f_mopzbnMHSf4m(M2))Y>CrjOM#=8}Q)LT0yyLH(Ta zY>B>N?K(~O`LkF_A8%yx6+O{mMuy1!g+#tgMyWqn7K*qkqu_=R$=SgU%B8h4bdOnk zceYrF^Af%X(_%vk-E}#742uoNp8)Un%P~sjoS%dbTJDrKK9u-#_jnTGW2JIh8=;ZXPF&rx`Xja!?@K$Wk;B5{nBlqf~Y~JCA#?>zR&yLcGrjqgHKc zyO8)>QmN^D9lS4j7fxm8h>-k?1{<~0*_m?Kgu`xN$PoiYvRcS#)AK;; zZuyn)3f(FHbP?U=+~>P4EvZneC=0*)l8E9BiP^J)5Bf}_S-xb%S`vn+SMjDhaPHW# zgXGDRyF%UsafIG_idU92__{*=4yd-GcHpd3sgf(?-9vD2u(pGt+Oq$zfFmY^hv7b? z5yJa>uuGgr|0T|w;?b#1EIg&-^ZNN2@JSQ0_FhZJ60f;~ybVIF)f$uk-U@1r zyv*tClU&#S3v6LLxNjqs7(@w!mObhbkD~lYlk$ZF{2Rj(7KbU|uQgo%JYslsGYtQ% zsd?2q{m&shJY0J&{>~jZm5=R_)1EA`TbWeEO0;4-LX*7hMmlcRGq83%X{6@bF7_m& z5apyoK=y^|7*{P8Td0v=?+Hm1!gRxIrE3ZUTWnT(7qoKryaz+B=qM{B=JrDqfm!4D zAkxHwr(zHZk!h7x=&|%^b};}{e!_(~E97&>GY5|z8A+Nwp1yf(VjO_CkjxodJqauv zOOw<>7B_g}FUL(&!Sv0ZWGEcZl~YC>LaeXGI(W~|!O@#WDt;J4%Tx}H#HyL@$WRkK zFT$KERt7Eipi0#kN|+3EUuWi7osZMIW}64J*kz9Iz4;u>giDRpJp)kym- zdWO}FBW1LSrdte5s1rxD7!xb*s|hLt_r$pUDy@#uXAR^QL#cB?yBHPSOp7@HcTF9_5a+N2=%g3=>NO_~` zG33`9=()yB^XjqWk@jI#vWaotVV#k|^Pg{`V<;J6;`{4TXJsuYuQN5G zd5eCAZ8s4k4WMMvIBLkywRDFETjhFLF-)3fR&R2pojA=Ot(}~_E{0UNgP>p|c?wE@ zaK(dEC1a^A_l}h^=J+s{T5|m3N>8%Oah((}VXYa5{Kelw_xv_?9Q5K$5)0l}&7_ul z>q`7FYeY_ozjwa}&8o$aORSmRD?G8K6$44++!v&0M6Ea`uJOQ>+D6Ow$-l4<5jnX`MMZWH_PmW>UOYi*LW}#Fw3F;)qQ`=dRu8+@dT8Htmr+jTrorQ@431 zx_#N3Zz=~ce)cxa?L;}XI`jqkdO!oD*TmB|meq?6QJ`{Z(q}CtX|~6F7+Km(_>)9j z!Gn_Jv#?|QP{wZ$WyUX~T;Xp3LjY+K5pe~*PpUsf#1-BhBCg;?s=tVcD@>({p=H5%ei90qQ>Cb@Go+d$W^p ztI|QNnwobV+cY9BkUt(VMmp^Nl0X}+ zrF@-B#WAUrmB>hgn1oKK8VXB-7N_gcSb)p7XEl~6)I@LVw z1a>)Ab*$u8$63-?wfg;`QY_s?=9t9uNGeNBBJF@^A=gSz>gP-^QLZn-1fs|WLWq0h zwsHBI7)i&KE2#65S=!0LGoJkX#6j1h7OG1-aY$Wi^H;9&Y3^>WV+HMzlCXr37i&aF zn77o4if@p1gtRAhNyS%T8plwO@alP_PE4qraKuDl^G-(oR3TgvYuw;^ zDAkjqGZ=B)y2MTYWcaGiEHVzeAvrBR{h0k5_po;1S}L|~gnw*|*5~{#RHFB8a_-?J zzG_jAT5YFb&Y2E-d@M$9e+=@ZtB%^+Pw1+4tY%AG#T6qWz{f;HWHbS(Q{Z?OhC?i9 zorIg?PEjTM$K3MCO{EeAB+P+T`S@Bb+R}MXZ{OzJ$(7WtQ=4xlAHXxYr*tgNWdAo% ztHb;opw?7=*Vk26R_nicBNm-^S~~O_$%IK$`K(@1SLmNZxY9*N#V?F@O8V>AaN9^wxSlQ7OxQdf1ehE= z3DVLDiL+QhCaMxG17%^@~kgvFWG3ut9`kW?6dc#MvdL3-}R{b!$* zAe;J@K#djQLMY3obFlHUiCYmmwp}t3A>GJ}63KybQ#p9g$gCqK(r2`h+U!7v5*~}b zls?0SP@cMBW?zJZrdjO7$a#RDjkHllwn-gb3(>Pn;^oa^<%X2`#3KVcMbC+s>$gbd zRm@>$=UFpHZksqH3i!xh$|=Oyri764#fm->b7;&q^84smbIr)I6DBfcwvtlfMoPJq zI#d}WMNiq&S_uy}b4cVpb;rQD2>lDgNab5Or=4xCe2Cj^WBPDncmm(cf;I@l`pcqLRvzGM!z z$nlL39Z{05HV-GiI8{z*QwQ%Dx%SA!&v&7W7@@f&{%$Gj3DMySsb8yEj8n6Y^^(T* zFsaA14%SOMyDjyo^010=Huj={5}B-|5<;$g>>u3pp#DD7OMc>p8~-5wyqijm(%f&m zfiX3c%R?@GpUH!uy`yP7GK}MU$72pTPVx6UF(qg%v)=!hYRiw4d_xOH1vg{!pd`GP z{X6EJJwhJ82tq>R@QS}k{m!FF?W?2vgvI3Yiq$%Y1ibF15-FK_SPoIH=m6%QJ3?N+ zc%our2|6~7#seR7V)tln?i@~|K~EDMhjH=1S2WFCnfl8Q(>T933%{w)wv65R#5#pB zk6N*&&ISBGyFX??o! z?}lny88c?oTu;=q@FsoeU*)Evpa_NX-Q6K%BSg9xHS1h8yN&a~dfv-m(`NpSHX$Ro zjD!l2ORapHQ#pia8MzcGhMJIYwaUqd61GF)+=+rJ`7QW_3jr5`qX=!~tTt@V4eSw; zq!(gZE}MlELSCG+$&$YiXLWCgi~;HW?IiKFlRvNpHif#gXeG+a;0BE4dJ5 z3A-r9iABhGvGfj(-xT5}y6~3r)E7O*Nf}j|9wN_9x%O1ZVx+-NOVPE`{}Czw)fmyI z#P=3*p34Vz+;+}<7ZcK*+eh>fZD8eXz4m=gkqlM}2+2Kl)4=H{9hv+@Z*s5ldAGXs zs#eN5DrEDL+)yyRmBK>C58ly}Rpdz_c^;NBXOrUqIaXy>da}go*(Uiu7yUNMCG9cF zz_AF?TN)cNkz#Dg@rRoxJjP#0@uo2XE6&A98ef$|Yt2e~+JGv+9Q~T+dvAZ1ymce^86I6$=m- z|J%g$O~`n`f(6;QaU&^Gqfu$rDLCs@T~~`rDOZ`7<#b+qz068as@_y8s@_y`s$3Q+gJ!sC$0Do5 zNnF29BA$TP^G$s3Yw;uvRSu;SrDIhW33d2J?Lut~=qQ4(-@`9MHjI%$Jhu3eK9xTnItwRH zo+3O}EaAL`$)Cc?cMV$c{@4{X6zexyJ>`iZBZ58d8TUf1WX+gD9zJ=Z!~pO%T3zYb zNSU=DSps9Z^Uy-pOeu+venL>F?ZxrEP_gz4n`xW73c34DqgY@JDRUPkTQU>R9^K=q zHGoWMlM?yxGN-RSA$`X5@=%+|mMt}rx36&e#&hzNEJhmLWA;fIZ3a)W=gCiU@0U7w z9dAO$|J(9HJX^MeW%S%|YT)&)d%PpMZ57K^0wq7SzPQ$zU?Af9dYb-ln6;~h8=5FXAMQuN@ok@_$OV4_i}n&L*m4au6M>)_j)kLarsqrpjg% zQ{1lPROOKS6T;M5#&(g{td-FrWt8*Z6xNCV-^jRXEC1J4Q*pzM{|Wyb8Fy$ihicYX zAx^s3*Jn9(@}Kgz_Aoh*|7WPa>c5xab*LFe;@Y9m%}ai17E8Md@6v9r#Fe?&E>>{gtZWcL#s8?YZH`yN|a?#??!uKLtgu zf0KkdY|hO{EKVY>U~`djZF7=@nB_KhMo)Cnuezta0v9oU1&PwJ zCL+(yYp)+$hz#?i-{OUoNFGN-bleMh63eE_rlqIIz3cvjFfEFdQMqWuD`Nh;!n)yx z8ws$5%c$(eUkHb`O2wTZBhycrn0C&@!+6!9zuF;r37Ma|+ss3=kYrcbZ^P-f;oKqf zk3jAdqBZS+2Mf-cn0?mBf+J>5i7W|5!hhn==JhVXp}BcPJU7yJw+E}P83>cmKRuBC zDX8fy9TWF?FjwmROoUpO-F4|5g4#EF(q1!9rS1K_`f^``6W7GJgK%l*(peA4_!-W^Zvi!?}|lWO%EP`h?@>VG?u z(BIq{{5b;}Hs^BUYr&gn{mE2roLI|@m1kUmFY(~mOuibh#&!1Rad+n!GWZwdMGm$T z6wsw)`Lzcu9W;XTZ%LWw*7WD2k2-NBBAU>!#08IHXw%AkSiLTFYuBPiokm=G8bXiO z{Rs*^&EP@HG+)WrabQw=CTx7*I&&i8;Vqs^GrqfLAv4!HckKKlI6miVN|mTYy?XVi zS-Cu222Xym+}fKU3hfqi&sAd|aU!8*YSg z=*Lf(y#0w5HnKwgFe$ zihHTa8zE`2R-NWQ{32ZbI=zjZTa>FXwRhQuqaN&uK>G+WF}G8*uv#1~&4hcMQ2D9t z>UTuh=~FR|E_rQOW7XQ%PM=-vKDp+02Tm0!Zv^U6?E>_Y9Fs&4rG`gOw%Hx%S?c~{_Yx`q4=aM)jC5bqkI4s-NEI?gX! z?FxwF&b1&hRHC?X;{hfKu}9qCh{(v_WX69T?9T`{ z=V0lo6|7ymkx!BwXYjJq5*|yuR+SDS!<}^L(T$rteXa;Zh<1)Oj4PM#lA%a#+SDqb z1%*AjPtXG=iLyn95`6zDwwT9+JbStDSKRYwJbC(rs90xPvBpLb6&XfINSNgIpNM%H zf!%h4C0m`kxVvmB=kerOxF=0|btkX3M7)F02SGdxRdZaDcbqHD$HEo_4=x<$@Ug2r zOPJiXM)4phh{xdxl+4b3SDfb>leRKz&abo`GnU9D?dULevlh#VIPP6{FlOUwRuULMSYn8ai{sJ#Ai~rx9xgl!xhHy;x(a`_J%nCAO@*)KvTD^T)^FX-dv`Z7 zdW&N$=LxS$pwinzsAf7&Pe`i`H*uS>Hl@ z-DVh9cl^RZTTK@2o6jd{uQ77Im_@pHE?zsuS@|WNFu$^A8q4=y=W*n#RQHj@tJZh9 z$hn#g8@DobXdTSqkGX#J?tj#|?f!1AJvtHl79jrw^;S;x@lyQjvqQjEp!WIy`KW{t$xhiyp5VnYhQy1Ig$1T``(O&Z+05=a%dHFPQk{ zoS7jKHcND;>c}j4E;u3bNSQ{QH)zJuzROaN`^+r4W6%h_6Hc9Pk$j_~4E!i^1x4za zcf>=}#qn?{n`ruHCBNuR$*%~t`UQy`vu_$SLaxa2?u#ZaNcZySp^0IlhY_L&hsby9 zo{>!t^%{A;A;&vH^&AkHSBcK29WxQ5=}OX&vh9>It(NdPa<5tf^K7)*dS1uYGbS!c z+Ulc8)%NyYbe3h=y~Jg4!wokQAl;f9?-~wG8c%_rj?pIFE*4)_9hVWKN%_UgAmimL z!9m{25-c2Epo5#>?>~<}^w+9_2vssNV8XV7` zk}{na^O{#=kv6#*Op8jLc%l~I5^}k4`f!Hy{ejP??8fflgO9Htmo|;3_w)nYST%

@L*( zv@g>pjG$$Q?-7-8anVRR^c>8L;onm_Z*!@Umr&n9m^~6|&q>;hQlDYFN7KFMJg(i? zN4x4BxGXlw;R)^OJz*ag4=tc+lTl)1UFZDOYpmFD#C5mapQOu{!pjGP7S2>R3n!y|;t(N$r%*W}!tMn>-(i_6g)4qqm(;-na0%#0wIFxL3%m zT7^QvDiI2&wUa)Hl}~cpxF%#vZ95Ns}Wz%zB~I*y4qFzK9u28H5jnZd64r|&vr zCOnyiuivw>Leh9B^0~6p+E^aZRmVaWI_0o4>xhwiPsJE`V5d`23zd^Ph;(MB&El$6 z&R3i<;+@t;jdTv?A2E?VtA#IeI;4$C-TT>jKhVJkIV@C52E$Jns4r<(^wlx`jDe@& z23B6zQ?G;t4>6eL1?e(^?x)rf<<*X2Bu|0R5G;>mCqf=ok?~DC+ zUg~JS)me`xg}9#(l55gtoki#Jw}|LGLsIAFOnXk4iAXNx%i>^y$f~CASBm_;>1=$I zTupL`4&>IXQqJ9%jHs7UMw`^hZ9PfFs_TE$K*NF-vc?#geoN2uFe9hcyo4z5(Gw#V z!gO2}!|I?^Lf!mUJY8)=xf-3nW8%Pb2aQDU*KQcOrR-=4KPQIW?Re*G`9&e(hwM@o z(e+_zbEjiomc

+;GB8#@{)FGH~h{awLC*!P~;v$-he2%gtI$9v&QAwh&95eti0A zbH?{B&7yseDU#|iXHMQ(T zVZIsNj2309Q=>^cviQ3Ml6)O_Q=rs`d{DYHC3B~fFc~ey(83-sL<4rro=D7x-!W!* zf0|X##?y#6?3OrkmTy7-5tAqoa+pK$NvU0~6m2^;Cy73ah&Y?5;xQRMXwHC|2 zrVE4WMKWvNVumh!&X8H(((a3aR5LGT@w0-|E?bIkT9tF9CNOy5{QHc#ZS`p z^Ky_vh`CN%Aw>S_)CchnR-f=-;9)ao!gbo_Gs24n&dqjwJsjE$Xn@?OWOw zJu)zQpP8LcbUcod*e<21zsiNiU-Al+uI-q}T_UTM*kAG+9R}(@NFx&mP|CBkC%Mb!>etaF)L}uNgh!qdL1CWoC znb$zRgF~*J`A?WT%a8DcF>PzlVQA6BHWbDB^>A@+4Rx1Z&B5qCs7}&wOF8 zQ{|J9y@yourZ$&}87fdBsDG#7MLC~O8keP%C<|Mv*x#g6ePp%tFbsKQo42_xw4NFT zC)cMV=Gz*DMPh}SDRG6eqmx9gvLbNM41bLUyLK2X)#rT-Uy?#U+bD!!e~}<1^};b* z?S8jmqFF39Ro+{VaLfC@jz6grlLf~3mP+2{m`{dmBJy=T`tsff7jV z{p1#o(yC>ZsY4H=G}F#$|F0BB;c0Ad-kfov#hz^g&O0~Cg-PZs{SX_>jfsJS z0W9r^BM=B+pzSE_dQ8jF?5tDK?P_x!hp13hjdl`DiMD~lyKs>3jy%>RoU}|OSCDEo6aPUAFnkpf38M@vuM~#mJR~qO=(_@ zD?+{imt)G^sG%~CN3>wk^?aKyVANy2DU{YbMb`K&e~2gxOQ!&1~h`m$Mx7FS(gi@$YMMCX)9tm8~E3l?+FxIwN>lFD$xiI?v;rth3jI}y1}CRv^?M)B#7-OkK(v=M_8m6wQie&1ol?% z$aoT2Kf4MvQ=8oYY?#r|(GWXA{s?5I@(2xzt|aV9Hc^p=DC<`0zcO^E^X96eaY~@A zg7{*jq;#+J=oNNy!3=)mdgu(x0(z)z%oYHlL@)>V$uA%;<|!xC~QmNqRHwi;=#E6)Pnw ze(EJPwK+LozoeQSrq~#kcB0Fb0nSSPKxFVCqt|Wr9j{?3!xNh|i!D@_YI;sT1^$OP zNCS78YH=9z<9GwJ#hz~8gV7>>>jEQqS5eY%meUQ}nw(=2jGAAqPL&$Y)+T;*mEQlc zF_p!+Fn$Qf@>Sy@`|^p@i9#EYByz1Av?^;?7l%&MFEut?Q~lOBn#z~K=#eE8Qo5ym zPC|2=)wlne(F{4^3@>a%#~>(V#<8x|Uf^$K9YHndw!tw;qxuk-_wN5B{;%d}sbO)f z)fdPhMrF)CrHAY-JG|}B5hIRODjBx^bBs_?JU&4$Qh4`YDrJ08x`H%_>H?QM4uY{z z8=s@lKT<~|nB1|>V|KiTluWEr!N-kgp6_zt?3ayhkF=6MQFXE6g)0W8 zjM*kwFElM?^WT3fJtH*OpMQ7 zr#vJ-DiBTx|#xs3!X~e`UVH555m(cN<6Dd--+VlS{wsPhky(t+9Eg+bt6k zznIJL1bJd3(Xd)P&q;APsPyA3vq(a=D|>IofN2%$lhyjVgozB_AUfqT2X(^SMUm+| zW5k1b2&M$wAegw_ip}QL5GhM{4%cqAe(8l{6rcQd<~;v(nL5YypNg$$`L^C(!W!?< z8T1InZ!FJeq`ieUIM2)w@rbUgn$<%Dw3hBrV^xB?E&ShTB;AROVf*uay2I#m#J(8=W1Tl$0=Szqax>C6|2(HW3?%CwHm<;>uMs>QpM<8u8lf+M1q zkThmwSwC2_oen`;YjnCzhvSS+ZDOE$*!mX2(^_VP1&|HfU^}aVb5X=^{@Ob=U}N-8 z7%Pd=)$@KyhFQEVHD;81fI4cB@3slTHx-?jfjKuV`JIfUG+$4S1>ch*7!hyr@tF5Q zE3@ZEp1aC$V77VjX6tZv#?i^l=s%<1c`p%pLRY^qTJy?zu9VaM-QVld+jFpO2BoA7 zjFq8)4y8C@sDQVwJkOc<1ZU8m3%2a6*eXf)FAN!0fZ~Md{%}(UG|qNZ!eWid?i;z- zf_>@P3%{_W^J5zd1_Ejl^B0nM-9z%ij> z2o6S8K{bSkwD$ZB!XgE?<`jB45H+hTH+jh&N)ER%NJB9sN?2}h%0;jZf<`Juc?8n( z(j%f$0CYFyf26$d!K;T#4ijJY>RI zbIrJTYOH{8xu6Q_&l)3ij;u7#VT`Y zIto%t-Ck>D!C{#w0$cI|gk(J3GA{5PkgSK28K-SEGJ+!pZn5^Vg7YLuENwzcRcjK! z>k30g1@DiM!_93M4y`bA@JIr6W3QLz9slb=%~pBz#{I=r-iUq-m%q*F*!atl2mEN} z7srIQ-+ZTQzM@Ouk1$^bV#%rXnn0i53nI0rO96^R6BgoMSVX_ohyk?=6PKN6SZ6Fx=y*c5%50-$pyqO6xT*5h2kI z7&|H7BPxv|eMevD961UucP}${(wmQDT2%7s1u4H~S2Q zW>qYzR3Yx2JBvc&E67vGaP`PVnwO*4BS|UeaCm%mH!Q`%Ou(+Pp}Ho-Z0OuONdHfJ zkQ4c)GCIV7UV7`T=A>T`VfT3_t+&LQ$2veViwc`QHc3}1T4q(JzL9L#%v$Ei{;OMJ z8LI`KY1Y~Uc_&gOB@C+TQ0+3$pD}COm{F9@EyzjG+khzoo#2KavHp*)*Jzm zA(IWVlvH^{GDTkz4EUJ`xWcez&+J^w8Sa;}MEcx>XWm`aacO z)W%IKc5m}Bs7y#mJc^HR4iO8+o8(I$er3_Ce0VE4rx-d;W$a!ZfITfu(Q*_B{=9Kb z*^ZxrdYO+Y#E47tP;^IcNlj)Bq`9lwqD7fEl&*16aDhW5_eT>C1^b`V=|PiRUxKN8 zB0l=bpQ>`6dBq|k#Ea4Pd05G@WFoljs`F)JOri(w3dgBG{@hmi8Rl`JrdyfiRWvX? z0Q{jQfl0sDBLzz;WBi#qOAl1h*7hr(>CPnKDIw$TC3vzGs^maErR>cTX7|wm)puJk zf6!YDs^<6$ibyc=mEXBvlkv|!d@NEi6-rpikRSWZpD|%t6l@_MfxL8Y=-74L>ukLWRqw$u5UVpkP|*31yi+e4Q+uXeW?N8=S#IB)Hkj)!Ep~uXrdRhc zCuU}Tnk{gU=}wMcVtb_`k{U>G5*repHZJ9tUcA*Zvy9dJY#=*TJ4o3BQ_TH?4OW}E$_dRyt%(?nBPHT!QLMmREa~A!1==rkt=X-gaZNKjbG(rQ) zPij;#nP6Nl?5gjwRoN}lauDq#7)dC@8~4p9A)tP`Q)@6$KV!s&aozw;Q%R1Bp<}XCYUyP)uGt0AuSWPWZR$JTk$h4WOGt^~;@+LP(4UN;p^~;8kz=nMS?jod@y$4)Oe1 z(m0$ct{>MHYIOL&ys(Qm*8gFx@se*1E11t$=u;^?CMHolNBq&VVNfgj$M17@zCT4d zrtsc8#8iRKyW;8N)LQ&Mn6c-#|Lh9-S-MRZid*X(fu-BN^XBTDw{O5Z?Egn5+j=8h zF3f=mbdb4Cf#ER|}p^!F#>3zi~5Vh+3r9*tCr}kLTY4!ay9|OZRJtYn| zA`iiHyauA$Oo}_yg=5=%m$mpkHVX)Ps_5xUl(lZG4rdJ)%k3J2H4?= z`*nZYKWfeW^e~J$U0p7KLW?<>$w}+iLYu|mZft$T`Ef zm#i>EwJ&UYBdF|85!jXM=ER})-GljE-nNgZ4sY3ims^E<9~#>iuGHkD48?b3J8lgV zyc&`3x-(e+HWW4;0av|U74f5`%3faAzZr&})11=hF==_UlRoMVnncn?Pp@8spO3U- zWW9b{*8UiKt%G@nS<>|?OF$d2oEQ=2*6T>Ncm*n#DHJ*O(}q|ZZv1f+lb3v8K0YugHTzwt^7NMNx z9xOC{8ld3V#0v=jxDK4+0ZpA>(;41rKVJU77ytEr)VUW3we+!wxqecgL3>G1B`jsz z*xHMnvg)5-N2`s=N$BY`>itLdP_u4#n!Yx6egNETaaB{qb_{E7j?|7owKaA`K^3B} z*(*E^k)V6{uHB+3I}!P3nK+9xJTRM~o0A45g%PGdnre-v;YBdSLFlpSCW?)p)$#fB z3qq?~Dy1gXW!$p-;fs)=8`0p;5%;#|&+Nhamb?3v2LLM`!r2-TJj_1FN}}KTECZ=R^9DC z`w93K_YrWv#cN?cCAV&3&ja<$`wqk8)49TyS*1%+Sv$?PnYH%csy%Se?YFJS{E3&t zdQcKl*v&2e|6f6!bsCRM&wlcYb$VV^qtEhc<*M!3bKPrS?vxc5VdQndjt3QaTlkHC0_@b_pgmA0 zLFDyx&*I_Nb0N?erEc5E>8#~gP$BF2ooych>$jU_cjy6_ux_}9!-#?hME!+vF4w9$ z7Q0d{`ggOc)8)@B^byu%-aovY1quc0c|wU(MlV-^;8TuodRv|r_TF@A=L&Q7S|j)M zc$-*Q_-=^a$mx=;AnJp;GMZQ33Kxebe~{*(LPMLjl{z=)-d)6#MOyHe5qD^dkpt$M zBQ9Kk(Pfa>jDzmoG-7Jl0-(ht6j77}M>0=GED!iQjzM^?ni4O$!5z+VUZD=Z7|KZ@ z#Mt?^l#4Q+IW(BTTe*{e@EqKJfsKKKD&xd?&)%wQX=ht*EVE~l_(hgDomiMR2Be#w zp*9CQ{XSu8l=*s;`Hd)sB&KXdL2W=nhlvT*Hdmi9EQmVg{-^<*-u`00>ksDJ+s0hL zlb#<6g-xBds1RjG?Rq0vqDp*EPY^HKO@QrUzvFO>Exhy04icIe(?LDCblTDpw#b0(6$bP{bp3tXI?_-yDfR`- z_$C_1{<+)X=jz@JlpgRsHjWRDs}pTTro!a4xVmq-CbH^|#%f;y2o5BZ7_=8Bb2*Kv zTi8MJA}T_Lqfk{3{1tnCuiv8<&wmmHwPw?5cR$4sC#6Z^L{R0?RE#piMIPZbz#pv% zSt_fpuzHzMAtv2Fmb%tRkY()KP%`tgykvgOHeFwl$g>uTWk^Y9AL=mJ8PqVJXl8c7 z7x4dt)gNW?av@bDzP7=viz+$UrfD&X7i{RC>av??l0Ko*(jx{#X z1NZ^8ULZqUQcsCo+>3eBlx3kQCF$+PWsNee_f~;nkAIF4&MA>~$)SR;l;yz7kU=E? zU+*1+!&-YK0Pijug8N-YaJ^Ge?00!PrF+;B+M7*~$i~9-0F(9f?*oC;Dw8oFhSi&O zo?^=@-o*2Hg~4KtewjDIrYMeDWz5gWqedn7Nn&|{0q1`@ALU$rYla=^eAe5S< zHG6|Y`{n|4XQ!cSWxeCTrONIh8Nz(7t<98hLLAN*Dmet%=FZ-`T+-&IXi#v>BuIA& zn4%C4CvYI>#ZRRWri~|+89OVpK}TyjoCk9s;&inn(NIAwvCKoV@TQh`!2lxwM=PsI z_d6{uj#{d-&yM4(hrCqtwL{rTL!92j$cDvac>3}m5J>dxnovB!RC!NNlYp zfP}_kunWogfWi@B>pCtkXkcb6#MI-}!NNX*}&CE(S zMLQx~D;#&AX(6r-%i%=PS?u;N>K8>t;+&>EXFg;ERf>>EKtv&@N0*7l7`_Z4hB673 z#6<;?C#a3&B)qQXd5Js;Oi8q5`B{;rhf289s`R}|<$c8TH+fCOPeQn`4^_n?B<>yf z`%TmYg|A3Bdd*)FbJN)_LpYFj194jtg`M!l5OA$?#Y5ci$Vl^k}09!Zf!IUy6jw*AenvlZ+IFzfp$9&4T}FL9T&Ryrg7%|3k7! z0N##`It2|sVS8674-c++gQ(f7Q|i{o?6#)nO!fIpgpU?f8usXlQYx3{F@gRR1vBr{^29VnpYF#FF1Y8+Q{I!y@vrRauiIxzbsk6cQ1*h2P&uusv(z zg;?w3r5*nr0}ghyNkXDJDWs|?%%)d&LbtCgZ??|GbP>&JB?`kfdIlzhcVYCq1q?Ys zyqU6y6%Q8&#CF=ms%ZiJAbBaf*|A_1!aT9Qqc=F7R;1{356Q# z#oHioG_~=hb!gP%u@M$dd4Cz2@!gA{$VN>Bg2|PXjpi>_4$0JwN%2g6ucBc^HaPS<4w7sw(En=M3 zCvxB_dwh~PMWxGpDlXyt_K2Xt%C89NPq>JYEMeM%n8@aqA*w}L+(zw>#W67#r}TWx zP=@z_kP#Vwll~+bUZ~WYH4loqSABI#&&a^)cwrn#WX`o;Zb-!8J6revwxdBJZB4MR z9!srF*Z5gzFtIzsx32~Zhow*^X%3&Y+-N;4BpuDky!%g7o*ea_y%J{X9E%Ld*&a3c zP>IG;MecDO>wxs(@iCU&RI)msl4??VW4KQw`YU3a-0tq^qxA~dsYgK9U|54b^tDHK zZKbvEHUiCx%Y;9;ea08;nxoYfpRCWRM3W1Vh|mPxR)lrcT0nXz6RlKKs0?-LrZ!?I z@NRTx$u|!_YS^y?cA}?7%I-*!U102$nGYS@Eb>L*n&_t5>gkBfR7UmwOAq@*eU*b0 zqugqsd~HnLv_mJ3DMoxStdXbeFQvhvHF%Tc%w?xSR=A)Ej?U(m?zzu7R5JaW>D}SaVKMI#e}}C_^qE>yu!p{Ff03bv^BS?Kowz z2LiN7wm&>9^bZ{p#HO=%I57k(C!l8K238V>vrdFmkugFm(bEJ4Yj5MD2# zzPQ8=cz{aDpl&-2D=I0Kb_!u#d0Mo-Kw_20I>9d&4ReEumW9`G{2z5orM-=H*$fHc zkwm=E0)@1on02X=&VV@F zl=ZEkw0qHb|C73UbtBy0+aeic@9T7}2LWlMS7}DS0LRyU#B>hgRkP7bjr4y8d)kw9 zIR1qeF|8NIEW!dn*ym=@-WQGpB(Jus&0S3C0l}N1`WM8$dc0=LRPdn$Cpo9Bm+RZd zDSo1rST7^XGg%!ETI8H%Fsgs#63=_haK0vveRX5ILh~r);_V~NV%&c6@>je<(1h7U zjESK4wqnh7adkr9#vYMm|8udnUOCLi3{=iqca=K!?|PkgpWqthw}(@RgTD`KNuh;> z&Tgf!z#RyxBT&2y#8??UFCwNFDrWUhs}}w0{2{Cp2z}sn_#}c~Tp`Wqq*0g^vTQu%7X{5$4K3N^y5tr zP$V9Ki|*<0r$uaEmR(-ucQ}17%sZQy>LmR)#meouv%m7m`av!)dfjZkOOL+7YN%ynPdVV<&tX7*QJjGX2Enw#8ndzuYry zeYG#>1mLH&)Ju08JzM)J_mPJ#pB{y2kZF%oTSJ}8IG#vpf!~xdKsLmN?rY6ZM^mnW@X|eisg25xTneChJx> zkN!!Uk8tjzROMD8CwVWo?un>>CCPhR%9$D963lT4h=R*^H2D+wfZnm#4emLgRr*2} zY1~CQ?9`zE;;P1oN^HdCdp`GJ)}zS5i1NgTFNaRXOo zCw30_*mTs+ObAr97`gkCJBPNT+Iu}g^wR`9o`|)$(X@_((ZTtX*4k= z)@R!_1M{1%BV1*N|9wCTyf{RO^NbTKKjN_!OsS+3Lh@Y-(cj(fftiV0Gi8#4DA}$I z`r(%X6)xq@>LtfbVFMc)qsUf$5REfuYfwzEyW)Wg;4=OS_k7a z(Jl=KkQHbd5qLH{*)wFH zBV4Mgy>~b+a`wM--5J)j$fAGq_#h8U9|2m1hODUeVd+f%kDmBpyO)YKlH#kDB{WU zk&>}?D4#n{*V0_F^9#7eA9ddTW#3b4C@(XZ&tGNi+~O8_X;X2&r8$M$oFtdGf;>8x zp#6F+CNK&^;<8#UA+3#+Bgd&=eNyrm-yJcPs5lX}n7RIDuVUnAIg!SxYAwtgrE6(v zO5_`o<0Zgxc49oYT`7OF+ITKF6HY*u>SCA9*<2fGcGXjA<{U~RC>qVND~$5QM3vB< zN$S!NGc7|)2%3UHVrO{(YYuY6MzU7MQ6C~c$R*^jZsH-A;C_2G6I#4~6ed7{qfa%Z zXkE{+aLo90?;)aSSeQSPQn0f-G=y)G6EpUZIk-O60 zDFNOaNt%EHe7wB;!rwS4W-(-bqzn1XZF0VH?y3)OB?)hdxOnM2+&~VO1G+8sFt=FI zqI1?_;Odx2x>9K$JYB7S#x&m*r|00L2yj#9-x4e<76JSm(UuQ2yUjP*mjGupme~NV zechxcyuv1+7!6)P4~qgb?hWfmdHv^uhE0+i+lXtRU0?2lC@3ovR?Hn*9)mP(lSq40 zm#}gGjpAr!QJ&y1jr)ni%vhVzrZ#%oyMZ%eRkuU%5+RU1N8a1?JG)OV26T$@h+RcK z_vi1BXCyGPfn0G@7F0Q)hc+ReavVjh(*Q15Hk@n>;?!xMQh}Y5T6iBeMLw$tys18b zO6*-U*V{l`@#+^ru|@Y^PbH3s%fm;s2(G(Fe{xpLT-yB zm2110cxBW68mBI48s^ULv7-{j8<*gL@tboX%fNX)KMzq@gnBOSFP#(R9~p8|HC6U5 z?!pSPH;8N=!`O)|3xkZ-_$nVV4Pg#i0^&#Axu&unI6Wb;hx`9{^_T3m7wpXu3<$ zEXhW=G<^k@QW5O!E+%Y79__4Dn1=~Enw2Hmo%gRn^|Xj02@!tQy#J9#_@-I=$+!@ zLYb81;5hUpLZ)CQCoGb}yx72QiR+VMF4(`8SBcw0C!B|5BxUu=33^yWdpTEMCG@Th z$!m24F=)3*XY`~&y=s(mBy~ZBZj`z=nWID+`q#oafiipv32&%nxf>dM2?tVV5Sy2v`&*;kQRJRCdqu;Yy|77NJrhwG+vA!Dr{Zhdl&CwK-0n-P1o$Qv zPrEBuo0?ZRu8tFtmpPL11!s{1U0K5V!(H{j=zCD3Fs_U;=@GLk%5d|fo05kAi4ra6sXtbkISgW z_5umXW#HpuV4Az%qf)i+096}t#;EV`7I*RV)mZw!x~H&MH3g7iDZOidU8mH7BXk%%j?vom97GfS+5F>8+iuR&goN|~JHnwOg!!lMU)hfVl~l{XLxW> zu(%2B;f|x6cx4z41y#6~vITSixZ)95bOmaLgi527tfwSOU>ZQ{vN{`=%ImBm>(J*M zN6shMh;BqjCA9pTV=uFn0Ovw;Lx@NSG~;vw!WY!Se#mE;u(D_$8Fuh!C#~7v%i5#i zlU?`ac?|Unb#f)?%V!wathU&~_b572Q$pj`7%^Z44D)iaHkAdb5SAq=#Ck$;=jjq$ ze3KC(`G6O2JJbjRgZp%lh9(hq=Rt{PX{1Dgyrc;%ASU%;J9HeFzVu^_ZYkf;Ah;WtYB}%fr_s$CZJ6BOF8v>0jMlDc69SxKVC; zwl<3BVnQ>yU9jeoe4gU&4|}Mf8cUJMz^&{$s?=J=%kx{S?v|b|QJ~%2!1a9t(o4x5 zS-XjYhZLy9L0uHR}~_)6LAYhv0^{ zPnr4|#+sIly2Aqoaz%f{WQs2}RtZw{0x6cWpAd0KS!?l7l` zu0+Up8Hb7|RLH92!@7YfPYS>TRc(OA@N#1(H^qum;{N2?iZT+-^wKyq6^}Kh8Ax~4 z({G+@pZ6(TS`~e1c&z(DbfA^bMl;$S%8_iouw1%{q7e5TU!LC? z^(pAUDj1UY3hHpNCKNwt;+w*tg$d(aD&AaGzm6q;Of$vss>5r|cl~c(BY=bZLJy}e zVauhBylfcROT*mC_F9QN5v`+h@`(2x>LN0QlrDm3&EhO`{9@w{?c8$=yNKDEDX+nH zIefMgV8eyWoUU4M-92&qKGH(lyui>6j+ z_pGTy_#!1}xiQ4)I&2;?wI(z82}SWtq~B=od*<=M6jcF1DTS^DFKGsUXfzGrK^BMF z50gADH_-E4BC55dsmYHU*6is~mGaD20KP)0rS~v_%Qat$*|t6&RC1ZsIl8bgSy>Ks znkBokuEZMfM#nOe!;q>Jo--w`>P5@t5z=bH&5&1mJ!>d%@G8by$dB(-s{;}oU{__s z_fHpP_RI&kvQ5b5I{)rASch`M8yBEZOVSR!wX*{0L9r~w?bJ8((T)i3tH|0oq++O- zKjx!Uh~__yAwO`%j>+QMRHN|x$heVvAX8hjTRNQMb{@TQ`ZIlg{lS*!*NTgJ9_lZ{ z*tF#?@R9H5pqragu8bSTfVF=f@k>H1&e#9U;Fn~>_&v0_79t1~U8?NWn3Y9Zsx{UV z&HXN2w&r9K-4DOli}`aY*aOm$1ZX(?9ue9GDokuLCi)j+EfUyKmgFj*yRPk~LjRr* z+X=EqrkUC})ok0vPB_XOj(HR%8J!_B8Ya}hMVq9nM9c!k76fwAsh@{e=D-1lX2!v_ zR|f{@fpx1*b^_4g;HYcn3bp6C;k3nx9PbM?&K`ja^mcr=ROvW)pYPd9gV47`9C%vK z#-g#e)&t6394TLXAJ(aR-&o)ZnX`}Q{9H$Ul2GPNC8WDAUpR>DPDl_g0P=ed5o|4` zd_4Ais!7a${HCWU42Vx;3oQ>!&sRm>YlJFwpijo3&&jUr_mXK-MY+v>6KH3?^jd3e zpLExyF@z^eR6Kq;_o3sAcC701wYj03NZONYoCXEPaYjoB!!ZjEjOA|;RBwO4<0-Rv zKDHgy*Yol}f%l2dFkbq5O6>2rx%IHaq~n7T(22)H!jno%!^fU2?DqR?`;eK;|7^f6 za9loYca{A(i@D*ttm$9Zp!*l4lwSlY`RtA2`z^vGDfK=gx|*ma<2#n=nKQ{PlWVfV8T}8_ zQu}kojWG#M4*ee_D}{RdR*~qE3JG2l1$!wq>4GnIBUo4n738U2Z78*;z0bWzKJ+tn zMz)*co2J$6%6?;d3gNa~^gFL-_)aH-0s*ph_(zw0A_izSv zgn$jX;o}Py1sP6iYUqHXuc~sMl0C?~$q(d$)YS1a5K@mn)rM}7R!P)Cc*E&(Ic&P= za4fFrjWZkGwqfu!-8-jHrx=`wN05Y?^>;y;5?{of4(=>CR{UtBz!X(p5q%Sr`cbj> zWChhgyrc?;r28ya{Aw!XXCN(y%{}^KR9ax?U~XV7V{~IAmF4QmF<(bwe0RLrXhr#dC87_x9acqO_!nEn%Ua`G%eme66wcDf zDlb`bvu7)OoxHBmcWcX$`W~rsD?n`OECaj0mHD{Pq>}KRz<3tmJM`C1bLR{89@(Q( zwMI%%u0J{lwX&lFr}K;vEGjYBabx3}J~oQanw@6kytM8<3VDc8{$L+CVjx7o?nN_n z#<~$+NviAh{7IBYbjDVJENGv7BZiwf;RybFK?J3Ghpg+tN(f7z5TD--f&eb_?oYt4 zztK~@zJk4}VwF|u!}P0VyeGPeJ9l>KwaOt35*Rf!PlFFvQj@z3;{FN1K@fyBn7PJd zUi+1gn~_G|X!w}fl`$nlD&J^bO90wN+$ zg*58Gw_V~!RmyfU zAml0k*;+(u;oP>ZX;36d>y3=BK)xz)+TJuWqkopdX-mA?e@$y&LWN+^b|L+HH3j8e z+O*-yAkz4!QbXg)ygmMFcHUah3nrnI*I3k6s=;w_=u!?SpS}>AI`#zRn)SMcHP6rC z3kYcm#!`{%9nIePoa{awoPfn(l4#KX%GJbZ(_M(Gr5DF_$+%h z`1kipDcaMiJzA-5(tK@Jus6*8j~PhrFiM6j&(kyUa^x8+q=JtI&Odr2ugUet4oGML{-)sxLtupTy8Z#!%hKZ# zhICgJ8|qN@3S7+t5)I6jS0T22k5jecl50Z#lKo3#UYx~DyhnOQvcVGu*M=>{f?6W+ zea3DCNv|;WjhzK@X9R;Dw_n>Hurtv}M7Nl?_E+sb@3D+xbu*_LWrWv$mUZqN;-*RR zVhl25Z4luP+Ky_=@%t|9-Xt9jCPRQn-I`pOvpNFq_1CzSHB~QTT6(qq>P2annMpQ@ zH*^j(3*l#DZV|BcrV5{9Yr(M*9Z4&sdpUskh`+=}B)8`C=(ma#dhBQt-yC;s&NVLx z6anTLrfwRFM^?pH z9vY}74&rV+s1<`5vwm8HI#~%~!x2KTG)Xr!J-f7Z(uBPUavq_z)qBv`itjp$=q>xV2gE^+zTAAHUaK`4*pXkOi!P5k6)PDvQ?mSDqRM$Ti zW2uStl6iZt>&DKi)^4fGSV$Wg&?$=H0BT}8`vnkZ==WCNi!6ILRheFf{s6WBbujCJ z3W3YA{x#Eq&7y~skwnzqexUz4fn<4!+`PNyVoeS9XK$8ll`9&(rN)ppq1~yzEqDUL zvhBwRxfK%KD1W9z4NK~e)qGT+c z>qAw<%~KlofrSqU)dT`ndFouVx*`^`9z=8POyZQ$FHD^diW=(J%BQmjs*6dGwAdxXtQ zgm05|jl&Hz&vw$Yj}2Ubww(^sS0dgPDvm={Hj4e^Zf|R48e188OUaD&v~__Bwqq8Z zqH4oL1CN2#$7`#Rkk#LRWa9!urC6=GO%Zr}e5#fje}v{*taeyM5vNeVI1?~1w|x7F zcSR?3fM7e%^wkkGBnAL?m@iG9&yWvOEurlWa8%vriSJjvC>j1xX zxZk0s2VMndhEn(8w|1U}$%xIlS^;!XJ#e(uEpp1^dHCZ|7dK1;QhKSsbq`Xm$)@n6 zRJkgeOE`+OQTcBUCEOcp1QD=4xgYz67sL~C2yvF+(5{B-aw*iI!t51XZw7gY6wEw6 zn$Ofu+fLqSiy4%i&^7!j&JrQ}vfF7=N7s8W8y;)CqmZh_((@I@MM%~TAWc%Z2R;-I z9-JXye`xr=yuyQjFj6Qm6g9E!VJ z@!}4r#Vxp7ad-C?cS>-F;O;K@a_+tF_a}eyBze}}D{HPj*BoQw_=OVBi=I>M z<5jvQ;$nU9|Naot!J)A2-3#l2#fnH;{d`Gl{>|+&YHIz+j0~FeSca8Ok_dw;eS8@f z3`J5DjL6>JRg!xCbnW_gN@eQ^Q7n9qg^PWH1P50FcQU|FmUq7s%NwYinbg!m>-3p| zP|nVd9EYBS1X>6(nZu>D?weHsS9}St??mqwaGXjz8BU}M#(uP+p5<>5F8@0S&W{6b zuvRg!!)O4YJSUmt_{0g!Z~48P3$0uC{ny+^5l;E^A=(KP?0Ih@Az}SO;rW8}s?Ki* zunB^*^l+(q&^zw@0>2!{JcCt3#$<+RNCFicX9#-+GY5iu>90zGn$KYLTCfr#)RhWhpSGSfc|R{)hi zX<I32v|Vn<%CSQ2XUs#x?zWkfoI*!j^advL7eb^Hb@A_;E# zFd0Jc!C!?n*&!O?X5G*1ICzvlxMguAxx(IUd2StH!GzW5T(%K@c5|l8oc%k0$%C7) z0jxB+l{ z|K?RfyZ`>oj9^PVwHq;A-Ma|4#2JhtE{x)|yUVXnxWc~`qBfIbq>8ojTy!TqyG>M6 z3^uUceaC^duKZqf<;W1U_?2|lA0QVsU!u~>oqp@c)psGLAb(h}?x9%-fN%~-1dSgb zycX6&yG=DiH>(>NlJuU(zN|+ZHLg@V$FFpFO`B>5D08tlbK#Lx6|7Kxa4Fm8w6)Xz zZt$le*=d_V7s_oEa=#xWqf9P3PbL`~EvOk}E7ih#i^I@kPOU&H5|1>Cx9&HOg284l zZ|1McLstpUdkRtUC?|&dRhT{_UsakuBa-YFku%S4WkMtnhsAhJ{$g+6z3YEh_1eHW zRUM)3QlY#vIXU@hAf}RXxHKj2PJOflXpUZ}#_;?$*H5XFc}x4dzwLATTVX)ab+&v% z3JZ4vvH=4+?dsi`Ru@VAEuGrq7{dSyDnD41bZ@1hG&2}Wd9r@b&|P!9Gz0qz>wH=1 zfigzO`}udy(67zUaF%@A3 z$-eM#vp4=lyRnxj=eunvDgJYT*YLaSwAxBWYCnVxI{ePhR0CbwVk2I6X+`s8msXRt z$a7!C>Yx^E((~kVL6V8O<{8!{NUcDQ%D6-f^uS1ZL*S-5B=?DH$%5ccm_0MapK4(d zm>`r=QKJke0V1+>~DSHKQr29gAJ56KdVYnt~tNMx_)x;HTHESB``O~`4HJ( zC|msc5g7F}4_VK1Z^Q270s79gu^7 z4|C_?zF2Xz0}>Jv2<)XmDeJMAU74kuA6mb$yKCvi{)%VX;hq(;V9OE5cEwor!HCu= zS}S}g@~Wf(JUZSefr^{gelYc%nWcs7vOwibv^Zv#Q%S9f|G_!Q_<2EW=L5%lqTW^#5%J2NX+-8O*OFQT z5G&5x77B_K+VrSgR2*tTQf_XiXnhIIn!A4+ko1mo3f!J9Dco{6^b8)69q?IU@q5-A zKY5BdP>uzq6fW>pv8QO=m{sR;)wd;?Pd8NAbrQ?{0l%dEHPoFQ9f6aIt47T)a9H_z zb@nS-Y`qgwBi&D}H=+=aGnQcsz{B!N3;<*Ht&1> zDmzXpOz2R*m6ee8rjS=%#ztb$jrp1h-80of1T}%H6B3fy#9csw4oCU_*FZMYmBXS- zzXwF23BsFup5v@mI{gbZ{o=ZYoFOx?|EYV`bnt?xng! zX}x6KJ1&2b%u1KYZ=7PSARqbLS=#Dpj`D|y2x{rY%D|6d=6p3mOV$)hy(i2mR70^` zJoig^Q$KOdIV$1iDAxXu36iD^U0)z(mggG!CRVAD-u`Mvo40|zv5xw(SQZ+xXdIeXs6C<{h1_vi#b{+~kZ5ou&bP7pDn z({c$f{m)JwRkg~|ckBk~Qpdfaf_uY(k3GKWCkI+%f$YkER(b2SE zv)|x@e={OQADg91|N8T_Paab<0rs{0(FXAEaz}6pn_P+&+T@~IpQ7YOmhmfrp&zaI z1JbM4uAMo&+Q@fL7c~}i2jF&sym_ScG#SqBPEYqTZ(Z)~5BUrxjz#5B)|OI+t8Kr3 zv%wM8uvM<)TGeUZCys1pr8QSlCS)S3D=^bcPbyR1lbA2HOj}qRf#ZsgDbnf7cGh#V z%R4X+5jRc!$SiDJ=_)Fy$DU|S;=f)tk&g7XiC7r2ZW&GX8s}qOb>z4X`vIYgst~js zH7E>M)Notax5)G=GJYhWlhEyRdJKzL;+siyP0XD|#bKXddcx~=`fn=O*_m59P4^L9 z2wa%$Ve*1IMUtez zQ+YM!g{9n!_MY=MovDp_qf-=SDkOG{i#6QPXTIuFF)FR$k>uX8#F6nMpBN!G`hO4Y zZ6mNrbf87jCfu<7?C=p#SR~;OABJ0Kz8=}Yn2!8sbHQ4A5^J6vx?*0rOm2z?9?t{~ z=b?#HMI<#=CzvfYG*7=NO^(Z9{}UKOGTEX@pc3vs0j}y}zvSAh64}`pDMdGO%h1=c ztC2Mbv2kb~&JyBy@=Z)`-4~Ug?b}&($%7@}OG2%mRp^!WO%{ba{0ZM7U0d~B;w7J0 z8-%Jh!4;_b=*$`I2~sZ#?5rJYv(iZyMZAbUz5nSVhSo~b0&ocbW^!=tHM1`ygW`lr z2C5p*Ti#SBzXyfMOFpe_PvtYPk^_Tow0ei))p4~A5$Bajk94*we#f9uk=sG#)s6AS zRdfn23JYds^xC=C`H{OXWwP78!O)0(;^DJ97b(V zJ*rz-<;0}!Kt=P+C=|D627TWG`|?lC2;?Lwhpb*D(x6GV;Bs-|^)5$x8bs6ZD|$om z--0f>ZQgO@jF?VBwyrnr3Q0Ph-*HAYF{E`FWSs@3Z3^OezRPb$b)Nx8J-VBr*9Djh z%l>_PflIiAxTKakC$r|*gW4d&>H2BbHV3iaD_-(U@jaBCoIw~!)=7FlR5+mXarf@w z`-9ye?&D}-HV~O_kLmfxK;5%#sq}5xG)^n}kI5C5vnwW^LWQPFf9my@`5_irWiBc- zm^H%+ZYk|{0ptN4@Xc0{F=$-d!IpF?*>&pB;|*CVu!Y?bg1+HfW~fk>wGX9+o42sA zqUlZ21biq}lXHOyAK&GVF-?8mzO(1u&DahQ@+Jz zR<tQ4JMZTYNOkQWiDvusygP}q8ea#na-cCTqpK3?^7mvsuI(LyzEbPpi4@S3w9#+aYAD*7N z>3flJRJ@8KJ{WBBE|klAh7n1bc)Z{0!kV-benp8S73RUTlc-UIHGy$dAesLFz1JfhJ`#Yn*$T4Aw&@SLWo$PG9{ zk#j<&;8vVz1;uPaWHDnFe#PJ@V)1MoQDE(X68@6B%ejNl!E~g0urA-$a1)zk2E})5 z;j2;7Pk78T{3cy>nT>5*HZn;^i@R4I(?px7skL7$9G^6h*%Mge{6Fw7Z0BoD z{zS*MA4`qvC2rj3%{gauz4My< zrs5;ZWWm7^BYs;ZReR2~_ZsyYn`7_Bh1s`Rf8Mj#tolkskU%9t5NT38#HDGApDC!4 z6Hwk%5x%H26@ZWX{p;`d``qKukq#qXZu1@w`dtoT=CqOdBv~pU<@Iri%six1EBIrK zFbl4)oZ;Vm`o$ViMziD!vSvS%C{xYA1FurxheO`1SUk1`;q(^VQLvbl`ZO-L#y*sz zp%HkF;|&SiJNv?8##Lc3v?!ycxu|f#U+&~tP207AK+%SL2fFH&EF_-)w&%OdW_FG9 zhIk-v#I={uvwY$;`R`|-v`lW8#Yv(=Y8i*6!pZuhO(>K~%i?jhJvRlMJ-5Zm6vW}_<1OOXRAdD&YeJ=3pGdii5?|*_JdU>FJS$D>T9lG-wWfs>7T4Ts z60g<|a|yQk*4|G5j3LylP|7=6IDL_9U-%=rmF2u?OS6zn@VOK#YUSWq(*xTkRNlp) z&dNMX%buE}iU5Op?Az%;>NJ5TQ3G(Z_-cJ`d|2grIW5VLWr;TEnMFm}W6H&hm#mmK zUt<8oyXKKiO)0E&lG;bN{FvAcB!f3)5PyAy3lzV^{V80`a-~ktGY3<6#ZufBa*1&F(r@W(!9p-aRxiQ8naP(O5MORX`QNZSwRu%TF9fx; zUi)(XS$EF1w?GOQE+m>Rbaq(d<13pyNj{p($1}vWL&I|z86RtFho0?gp=uDz8VLMNpD{5ABrS;ecwPGuN<do;EgS`*UlIDCUPZ6q$Qb-pXk+^XC$t$k-Mj&Yr}_Db%5tp4)S#sM`NfsqdR>k<_TBeh!g%Tch=kOFF-Oa3oWd z+g8y9D9BH+J$WG7_HThA&>^V2wW|WKDwR${e?q_g2We^kcsLRD-9GnYEM2tAM=NNX zikWV6wsgri0kf*gU-p%T$%3m4nV*k5g7|<{^*#rfnx{Gg(1&SH+;l;(HLitb&{7&j zD|;&;G36#+dX8KxR5!aD^BoXlN3#H3nS$Z%t7vSRDd=n?_8rDY5Qr*pwnss-#r$Ez%ibZoQX=^FE~A&b#0_o<`iY)aAJ67OPu?fSP~AXC#ZFa!SA+PKU>CH}8=c@5M2e=puNhs_pV~By z_kh(+Zzun=m|k*KD{YUM2bNsYyZI)C9p4d%LKa{4Fot^6N&r?y@zDkRJheV$vTo0n z(PJW~Kk)*&y6Ia!?Q=f?l49z>eQiFm+ZU;F;kAwy=WI_RHMZue6(UuIFA5duc8y3b z-?!dlqC51i8h>za>Zv#nnBZCe#IJbTKT2Jx!&{57^s9N_g8zOnm4wHUXk6{7=DCH# zNBX+2`77Jw^?u}2Bmrv|p4`G!`THW9kuljyT*I~2N!PByUiZc!#Oi zSe|h-1Y~K(s8;RVL|X|m)yFOB3`R|;Np-EEyxV4^X(Bh-90K2Ww@Br-I_+)1nTQ-_Vwu6sFhbHKSsB= z8zB4WxT6P#b<;|vlY0ui-q0Imck}FFofuC)Vkp=f@>5+~Nr2bv7Q1mr1A+}RJidx= zojutWE2O+rmQ~cNy~N8^9s0U3;)JcaQGFeke6HXcS$|1l8~$vb`t0b;z?_`FgK)Ry;;Qsrq5lTMz0MJ3+ zu^1+C$;xZH`Xjk=sm8pYxg+>@^7Ftk>un$fvo)OvRZiw=yvo?}n`54@v{Hh(Q_#sr z=*OP$MC{Kz2`Ik`z&mO#Vdkl{pMm9+&mgH&j*;0)h)Z}Q0&yoZ2QKq z`Hw!IgFV&)%v{4n^5m2n?S{2myaa+jYJm!;(PUYB=hi4Y&(x@P<-f{&6Q3LdN$!pQ zJHg6OeILp6Q{d7LzqtY#rm$Gy?NIX3$y17moh@TDqW8(`Zui}5StjD$ffG;~`T21) zrry;4LIn3$lzfo&-HqxhQYD0yPj~CPGrO9{$o_iOKhVUJO^)jCH2icok2hB8gLOfV zAI$LYfNpc>$tp6|7uo-;$4D+og@F}OruVQ~k9=|t%#e8OkJy~O83rqOXi}6|NAx$h zWnT!hzAfgFs9ACp`}1qfcsuPJ#*la2hV)b}bGm-Fsw+o-A1qE!t7v^0>6&0!D*FN} zZG}B0cSeSCeIKK?<1YTP@F9nDpLe@*A?Vg#7n-~NKKZ&zVVCs)wcDSDDrCDl;D^@K zck5nZ(-RP}h^ZLndv4p8qab3`pp{>akxdH%dJ_%8i)?2UL%|o8Uy6HwxjvSXF(0Ho z&rRNe9$T-apVc3whX~|Uip8UY|0@mzQm2fHw>J3W0OtP`b3jW3X!WM>ksm(y({8m10}%A#)q*Mb@lGxZ*vCy{?!#UW&8J z26xe!?U%@q6m717v>(94V}rFwH5c!Csi`13ud{^OSrPUC&(R%9*|hTpfIksf8+xDZ zyTjwq@p-WUPw0AcyLjfsB!PZM`kHtL9tP3=cf52GtAToZ;G39g1GsnRW zM!?`{;$J7?2ZOC+pV8ArI++;66=o*{w8h1-^5@!X0_+)-Vr&N?cJB_zI}+V6HAt3Q z@THTh=#=N*+(!*fHa^a$sqI|#P#Qf(tsAW7ECP<|OBFvE_R~9EPrWn5ECs7CFN&PZ zXCw>6)Rw8cMX+msChRuItS?ur3e0MyhGuHWO2D}bhq$Xy`}Y@un-*!bJg!^};X2-Y={^Hrqu@A=2g|(}C>skv z+{;@vK_NHX)j50Woyb}Ia{qtt9%-)GH4~gi2@_6lG^>E>pBpVHLpJNbWzCF*1czFS zRpwX-^M?n%L^_r38x{#9>~6`>#;+BQ#&^O&hxlJPJ0?Ecu;%nUVkYQZU7J7GP8AQu znz1*p10Vr76W8&oY4Qp6S7`LEL&{N0A!EbiGY&HmTrPLmE;h9Cz3Fvk>d*1JK0ZXd zy0QlyrEJSkc`vhw-A`8#tp?c?>}#y6=LeTjn}z^>RW?x|3Agz#|Ch&1K^*b%HNeH0 z?|{9%J=>)5=ghoR{9|dZqLQ8wPXU7#3fj?J#3m-Ws#}7 zH8A#(v=VIP1zgYDg;U4J3Vdt));Gw=TvXZlaRSr%`Z3_;K)0%4XSFeFC2U;cN=^rk z^W{~m|GqV=Tvn}-CJlE*^qqsUME|I2XP zNua~{VxZmia4oThti82@MKWJ?-6#uD{xW{H*mjJD(I)V)G|7ERC%;$yJF|!wbBa0L zt$aARKhg`&woj|L(7*W)zLV!fQD?3?`&*A5=vO)e?CBK1XR}L$KGd*4z+i7k)Q434 zZg(|_M#P;BbfaIDx!4I&^H_r!wxGWpX>9IgC8~148zbi62mhGZpRacYbEOg?iyqqhWRay!n6tS%D?4f*{#Tp z(%kWTRf>CUi!E)oAD+%0<3tRk9^IKjSvjd7KHREdf?1N8Jiz(*QcEA`K@OM6<{O*l zGuc;lXk?@lxn6t9%8A~_`98XqX`O0$Doy*GL6K&=uE=6Tke?&I;=+Fu2aD>-KS&c@z2;e;9 z-#j`)qXx1&EQenG3MQc*M^29$e><0ADV*%63BSX@GrnE>h0rNF(X1zTnzXqb3|oN< zRzV242I*9rXH}5;#_XbEhq7U4olw`UJoqJqfNbt!4IsyRs2H61=D01lND9L#pN)8- z!;Wfa`G%p;Ts&CR1o~V#bbQ?JQt@Yw=Ut~yGXrcn?3@y1>W#*)LK?ARx+ z;WuIlZ?Hp85vZh=&0^nvRMdQBI$i608aLIyJaSlSU>b~pKivtvW)Uk(dQXiq_f={m zz|m|M*$uzZtIP%3XXv|87&jYz==~E*qp^4vaf<#s^f!n+nlrVE(t%1E_1}eL3p-_G zX7`SfQI?Nkks359EV#@NlKOpZ1xss87p6C4=CHgddNQhwGd0$$Pn!BbId-hpePc<( zK7Xbz6<<~v0*!3OramX?{0o7p0u|glaF6NOb$VTVqir)+LDi4b7tO5= zJ891iXQd{O|4R2Te!8n9h2ZKlA)h%fISMnZi9`MH<947h;YO zrF?KFaeuAI>O#uOk2iQBRq39Tgq*E|+i%}pObKn|{jD=mWdK(T zj%=P>F{O0l&d(^xcned;0jMez!GVP!pzxw@Ut6ai?^Xuymg>Lc9(Tk8I$fiEPEa~| z4q|2@en)JxlRmYFnGz0I(@sfIf|?00-$zWHw%8WZ8H)8ZEy zmK)gsJTl1oDV#(Mx}UF}3|-IZ6sgQHg438##1V*e_V)uo6f4G` z&u_^yc4c3;-z{FAq9Y&e?tKYlvpY-+tu1uM7CPtdjX%l%3Xc@&sKF2zSCiYRQjFob zD>)^N9$*}t<%yVBWHDLy=A?rTw|MOGOSMJ)l42rZtD7&lO&;atzy@C(yM60`^E*80 zaSN2tg$}f;eH#75|Fl9ceGk5z6&!29lqLR7Pg9MBNhN$Ps>1z&KOXfC{z;|f6)2GO z^TS8(fLGs9WkCGD&pL63VXmV7{{G2CQ?yf0^;9I5Q&UrfT-mg;@&9KAa8qy&MnjFW zgipPcGQ!s!m=Vztu~p2GfQpN+e$15fVbCX6_w{tm#%oWWvd_={XgfOX@{CML?kLg! ztVrwx;f5=Q~E+RAkZl~{=@sj`O)_% zDK>;$*%wFbwoS(BMo<_q+JBIg6+75b2p%4A74*#_l@*J;P!eL^TJ$52z)KLyuz2sW z*C=V`FVT*$%G5tlkD~=mb4yc@p0*Qk3`i_H*CdJadr5z-mQ~yi`6v5No>u{6%IarkZvWt z-{UnZ6=I1Hd{q-mGD*NWQ7t9+UA zlCT)0b0Cv;sF+&6#dzR|nRk^ZUm}@0X4f~M862%Z&fsRJ>Ka$1lNp$3J-nNgHsz9B z@7(XMbdnV`%zo}Fb~K5m6MvGvplxcF7hWej@!ans2yEf|I1!@Sq=eKokuiKIRo=P_=r#>+pw0&q zf}@ zliV$Iur;4#nv|#T(w9X$uxp4oDK5WRA`o_x_4E8+6l=~5{9rP!1|O+ydaKKwNhwt< zhB|z93GPDDKm%RqqW^ZFkBROqs|3U@&B;R*7R!t0&M4P%|dDUhA#Kf=K-J&|SL9*H~^ zp&`_d;RF|5>9bD&DeeMaKfmEruKWdV-0NEkz|TNd|9WpdtIQMsvpq7NxIej!

6h z0rVKTo4WW##6R;D1%-S&Q#)meBqXD7d}fV|Zj>)cQosYNtE*DN2!K&?b02npV6hV0 z45)E(qJDlsHfLvN4Ct!{glHRf`o`23>-Ct5=ct5!xH^6DQL)SoDsA*^d2K|k%a@Sg zDkp!vt>)i+1Mmb8e=c!--4_&D(Z{=e_M0(zz3;e?K0OZi0}-J3`sVCan>s0Pz0Pv) z;QYZUA;%-M=9a$LhSB_tcK2-ctAgWhzMjGPavq5dySx>(B^x+lG^pq(pO(y}aZ5Mr zj5oG2n(vX3@kmK~24kiKeOhxdFa`>o6&QIix&WZ>D#KwBe7SNZ^_KSNR9y7r8UZH^ zL%)B29(B2}Vy9Cj$HKyLKV6YMnybVE1prE4{pHjD-wNog@{nE5#BkZ{H(-z7givr- zTJh)29!l9b$ElE5k^!?%DF(0Q(IPDVp6`c8QK^9w46h60Bg58=d%#tn*;`{!8p|6r zjQ`5YXDn0m9CD$Qf7bmaZOLy^{qXrtg-0eu3FY{_m^fa*!nB&ZWcGrGM268WDfJqZ z$$(-NT*<}{)9&Qtw(A!g)!%|SM?urK_+cHOfulm9J`4VZ@D|koD_)dM`}n3UplK(& zKTa;3Lp7B7Vt$uoeww|K?X1mcckCS3^oc}KZo+b|s;I%KKjL{L%gtbYR$mxyoTQ090{#awt}4XRurT8WZ|PwnUdz zq6gx+mX$H`>%@AYwm}0l)O@ugvL*Hu8dtdH3IS)7(pTbLIWg32D{4D&#IA6#$JO~u zKwtPyZWPH=SA*=kc8KR$u&QU$N)10b70S`nvv|3P*nS+L=fNhvL6=JJ8avTqHG${w zba`vku`f$pxrWPcK65EUDygU)k>z}K8F`}k4?gDE&84|wBF%I)hY$V7W|Gn#!|%QY zBE+gqA-l658G=x@c2D_*5hjqTZSbimPrdQgTf1t7f|GdS!{S+|RenGQebdg%_&d9$ zR*1b;M~lC8Ye}#707fOmP?N}Dfq=UqQ#qzi7EcwUNTZFqMAwx*y7PzNx}GG#K~Max zP@1sII~Blb&4VO*rEbb6#i;?;>bQC5M4?+=sg5=kCr@Pco=*|cvLhRd2HJYH#3cM{ z`LZL7;5%!OaTN}_Vn7Hg!&Qxmro?FNrZl~pwHBd6wYBNut7gUjhMvpyn1Vfj<{T%~ z1ng?kX!=*0pcVv%1WG)*L5gY<nrea zlPsV^g##7ld13S5fNlCEEs@Ia>1!!S=a3IDbY8Xd*B4R9LQ4fNbl{hnhJ^dd^cb;R z7UNOt3y0zlIT8Hrppzjsw!mk5I!D0H=lj{swN=iPC?q1M*AjzMwj zpgpqjGdDu**|YUpHP62l6{yYxU4XxFuNHUI-lJsn;=iP4G_Py-_!HBMR;5L9`y78C zh{_r&KtprSY?t2;Wa&_o$Klln`Y1m)_G+$d5@|Ws`7cvG7aGWsMG87y%gKk##N*^` z^;C^lEW4(1#s%mVlDG0ll@AKk?k(8Mzr>yk1;o|wDLXw4OOM_T7SFdhpWuc<)(E-p zjJWp6nc@TlfOFk7c18xBNewz9zp(dYa%fl_pgaUmKSVRM>h0HM)_Wsqx{0+x2&1Nu$>GcIIph$txIyXxb$saVN0jQ zKY>NnRF@x#+=us1M7(He1|b%k$KfJtd=bA=wNKaDCN}NcQ3=4?S87Mvd{%TUm@8pM zr3&Al#+2MoM26alY20tQ-#Qpud-KRx=jEP2L73fthtmpmM(qo z)v!t*-2o-CKdD@12pu=22cg}7s*jky+2~5}m`-B?(VL4xl3QbrBP$NG*WE3cL(eqc zM-omOG!AOkcD5BDJa%ApfX8daS66s_Ybb4SjMOdZLa%t*=g~Y z+JsGI;U<^JLQgKTMVd&Z08i+=@f9L(UZtVVZYK)maX3U7(7hB2&2SOGE*Tj*pV~?l zuK1wiGG{q*FPnonY#A=;oo;8I24h)eE(o}|1LE@H0S{o zc_rdhooA+UoY@FQ|G&^45OF3x#~!O$tuE*t%VWjvyfY!CicGTf9_Lky3+*C})s5bH zXG99ZdJucSXXLs7&#C~lXX=t!P8BWa&E=pGQlW}R4w)}30WVK?bsxvNWH%2j!iAb* z{YN#qbC+dsIMN;5Sn8j}I#z%&I)g_4G0Q{S`}qkhSb6EO7nFkDDB=dp zZ4=b8>#w;~(M94L3hKchNSqV(Vg)fY+e}(CV*F8_=RUnRVCUEe&+kk+x%}lUHZZFi zlK;xy9PdQYc1d+f5v{AhFg6?=I-2Z!;>Rctxz>=6+;8l{u zd`u@0rcA1wPGq!_(@yo?*K;yy{OGSmY54dP&5WZc&hy0(=aFd(oKY;N8j?A{Zp0tYa6CI;6I5IEqF;eJ zB;|#yzb=>HPVsHA0;lnDG6CeIo}M;c`6lqLt5%F;> zoGsk=PbuK0!b!MC;^Ma`Wog~I*KYq6xu=L72E%jX7gNZZ-)LsPp5(6=hKu~K%q>0# zghESqy+A8|Z>)+@c_Se=mUN*S4~`ERjhiQPY?;2~pL>yZa3POhP`IiveTS28%C(u% z-%j3^@2Bzz(HG`hxT)3j^M%)!m|K#ss-gXukFpdE{mQ%hPqS|$qn$aU9Yv6~MqKH4 zOBl%TyB39X()yvGy*18d7Udcny=@+v=A_Y>FcqbshjdMkT11}gnqG&A5S0}kNbYaE8mr7 zX)aa@g(Na=_D_VClFW9}w#xJ6YB`CUpntA~HLbMxA@9{m4buhfChw7uOm_y+DK%3& z3f)p+1iM)NvWx^Jj_oRTneI5fY(KL1wJ^rG08{Fn7fmsdtt_vWUQ4cR>JnL%>mTVZ zx-ViyD4t?j^xPjYDkryid~~|E2u}tf1(vItiC4E^hU^bOlbXKvndP{?X$rM5Cd`Zx zu6i|}$Eby|Z7{)bB0HbOs64w=_<}Ju(#+a;`9gye$*MF*;o$bvMnJr+(#^g$kRzBB zJvZ@CB(xboUv!MkOfag{yBQd_Y7j0TV!F-x^(U(=ZoK@b-Ptd?yZ}%>#`16)^v`7n zy;wPYLUjK>ahwc6dbidM#I(4?wNDic?yusN~qJ@(uwv&ZB}umA4@&I3bjg|!*) zaNi&l5CP#aiAjQ^D92O`mQQ>_nyv2t*IJ(G`cW{(O&A~awU11YUOzMOy?-otj7s<~ zpi_;z%xlkVH;(|(qc;6m#caWwooS~Iev<-#!l?9*)>(E(7qb^`sa6)RoqUPZ0Uj~YTvf}&7uan8K(T7Wd;;75#2FQWavP2PHd}2 zsL0Yn0P!H*F6qaoz#q|P+WozSEX2nmHod3!!@XWfkSnlaJw0S@kQSm9#?JU zQ8xX9HXviPt*(9sYjH76(>0?=!fY$jF>enf!-)E!NX|@>OJsli6iJ;6le*-=Z6szt zRZe2*0Pa6hST~naCRMDM8OJ6huNg(5+|Ff*lT54``WcEY0(8d-P%c!O7b7y3QnB0` z32!3EUozYEIvG(-~4T=nW1#Lkfsp3tv8)Xrv`?UUD_E`(%3(%BRgzq zAnR^QK3zOne3Y1ReXtTv-mi*HnH-cyf}c2+Ow>HmDCU>#?L}8@$=M z-iWvcw3F-=FtOH$w+J)qtkrU0kTnjLk1IHPeZduA$j!(+moZfy3hcc;Tnvu80ze(E zQR0QlWMH`BTOpMREX;-Rb81$bx1JoG$e5_)0nY6I->EJ4f;x}<) z)*lnrUk}wANS6a8{8+e+q3-%YxuJV5$FgM4A$Pqb9LD5JhUwv|C&V#EEXp9a{TI#b?3$%^;_!GQCE_ zFl1*Hh9URA`I(&@5Fs(PF@G8!VP80w-2LqXGC~)e(=D74!8>AWc6DR!NuQt-)W061 zysntr(FTa}yJanCh>79II+Skj@E6UHd%itWyfXXSZxUZ#lf+;yLmEDJ^f%R9umo1D zE<5IEYCo+5jw4uDmZy1yzWsXfI-6`JB{{02fHXr&(S(V4F})Ms#uA+#;I(KpQAAy6 z#xLLXJGmNlR!`=O(^zr$TWg3^w$V!lui3ktD|TkoG=$^uwHYbD|Kv-lbL^T# zqj5MM8_YaBh9uz&+j6Bb1(#&`kg5WGB<&7|Wi&*na@ zd8RObK-A(Y9#QC|32t|aa>9ZV`h&f2xJf{-9Jd|Z@o|AsN>2SYBw zjZ&Fy+4_A?0L$E>`u`+&yK?|S84*%Z46h>WR0m0({iZuU=ZLe&$q7fq%h0^(3L?`M zsqvpwsDC6tTwFa0S%zk74h#>yKyZC4tu8ICt#m=pD>9}X2yP5jPaFUc_m`~HOrYwW zcS%81tk58!W;k1-T;WZZ_5)Mg68gc87mGL&0xSuBAmlRq_4y4V&+0hCb0 zRqf4|Yne}GQ*<_jL6t+cx$#Iy!j+0?tf2+sZV2OPW8BhsgY~qoe|TJWaE@#g17*s> ztM-GK4Cr}xJR@1dztXQLDF?N*Ggk9H3F!{8>BBbK3_mv2FJnOf z*~JQJ+=PD+8S!u@Yjgd}1f?9YPQ+jzOk^gTA|pS>0K}VI{R8GgUe!$Xg_VR2g;m*w zF-ouQfih=ReNWpN{WmX1F6I||M0<~wEAagDfG?JTS)I6@x=*uF;%Isr&xaG1@4OSn z>X_?K9jnwXI%}JotrqJn8oo{SKnD=`WxcVj?da{v^1)JL`OZW04JTalwzT2)>mT`ftVe-AI9v(^@=w1}97^FpgrZ0D;A%?2U= zlOPwV&~1#sq!8A|=m+#6G*U(i8pb=~vU%U&i*dp?Iil6wAWFnpql(Pss-`P3Cg|(( zPhPyYk@Kj78{2v&1_q!ERdWj?maZ8E2xUg5qU?+P#g5WQe~5N3{+$nQuZ?E1lP z?zF%k;nF)@-MJYg-iBpDYnhWO>Db6x!&ojaLl0OAkCJsR>30@!l}kUH47Z~disT+8 zfcH++smGLb14n+kMm2m&`=1c1rrnRI|3k!5qDv2S)wF2r;lp`Xd#*4fwI)uVL;N}W zRhjFla70fz$ZzR8uY;#pKRu2OjZXr@`dQ)Len0qZ=jx8mt$oExhSfh|)qMs~uC_zif4mbbhO^=$`|!k6XYV}rf3(wXPcH8= z@$Co*nJwqP5>a>5Y5$GTW#c{Z*E-)gnf7}HMgPfidGaE(dsh2Gd4Ek!#&2)(bW3q8 z;{RhP=Zt{#zadj2FmL6NGJlIyuO)Glqj%Gx?6iW*B&T1bQx z*%h@3S@txot+i6uN6X2v{}0|kA-{P%{XvDPj*7JWy|;B78_x$>zH2_5r%m4>1b*jp zhCVw;%gVKBE!~IaP3S#p2GRnk--<3K!cwRFudbp}$rj?SCSZI_!>r{v`yrHFGZ*mU z2fY*Ib7m3EnhfQQPG~Oa9Hysq7xk(|+t##hJ&+~4uE*E;kPB4IR+v`0FCA3XX_D!IXkm&QWxf(c+9@hb6B%}EDgIX!sP70 zo=N>#fBhqRbtDFpObA{LliGFTVYCt3F9fgjO|Or4_c7|jSl(?E*CLHLiL#$FY6^jJ zCwxyXVa8d1ULTuD-A)TJi}ZI*=*Rk-LFi*6Ek5QBat#yO_2OAvD3e+@X5l$MWMPkK zS-Tp`FTRJMyL4(Zj#wea_s^fmd4B`SS9|F{_ZTu;IZKB%W!r-|Y?c3Bj7#(F$Er0b zWg(30F0SW&IPc#0;`jbN0pY({3QZl(D<2=CMAbD#2N4nzUx%YZgOHjk6)XP)Rx$oFqJPM~El=6A`anWJG*?gGB2F8`+0*yqZ<;BL*Y{r#5EtKxCi-&n z#hmfRAN|sk$)AV5W@fKi&*n{=DGc5ardYwf)eAfKZ()9*33CI1GsCO^9 zabp)duElQ$A6&%Fm-l%Uq@Y3n?qrK!_eG?kw{)yu5~q$umv|zxw0yqKa-J_s)nNK` zrKmr>G-F^)>nfZH7835oWu66zIFUE0)M^OTTMr|7!a0q44RM+;6s|s$SNC4>Q5&D; zr)&J;o=OYdNPKy0)Vo{6rme@u_3K%`aU)F}Zqi^}{4(?CLo8_qX+Ec+i}d5g<9D9~ z`{sdFnRZ2l2fXI`m7VOl6(8;|%4*NcJNSm$(x_h-GAFpnX@x-3Xg?K%}EDo=Y$np6z4Bg$ww+i{$-{BV=kcg^in5vv6odHVy2~*>GWu-8@X@##7j^ zehphUuY(hdSa|uP<#1i(J6=5T6HnJ?qWxcdkvA>FnpfkBxQ}PXcjj)gM(p0cjJWNC z+4?MsjYFpJI&%{gre9M+Ndi15D2U+T;LkH73H@mnb=*c}`>Fm(x6aYc1zmU)Hj3o5 z94d^G`c?3>cjD>EEx6Pi%it!B>Cvn@PU3i#5XcG}S88_XO{XR;=uj&w_piOcGiN0- zJB9HfBm#~9W1jkHP<*jimBDC3#!|(|oHifro3tiRI!ELRJ0e~mW9MEU^buibOhFu6 ze-I5G)al%Zjw1c`wX$&kx=24)WimU4@;)>I?fVBjey1U6%2MC1-I^B6XCGXehR=-hP}p^;DN)UZEyeQq#n z;CObd8O_*PmlF=MV#Uh;5>_$(6Y^-yJTfnTL|doB9FX)V3T*9cv5|Zt9i1@7y<}LE zw(L1}jDhX?a%lGo8nszwIktb*+-&oc1`!v~YuXV@*pI^odzU1nu!u_=vN)SjIhoke zr6$|oN@4!Asn(kal3;68vvKx#+O+M=*ga3d-VrAk7harM!KC#!3AucTKArl~t63Ko zY_u!6TuQ%^$9?VEBACZC=K>p-U`c^3>!e)agEvDYN$d?x>Q% zU`K;4y?C)~v1NPB)-bwtXn>O`gqf{-A(;;2Dpz92#EEpMU!NJrd_;(et)tq}s%r;2 z^k~ODp;H!gu1>eXlbA7X7%j(cw50WV&lHC3J=F=E@D` zZ9RvpyBEe6hp1R$2;J6Pr+FcFk*S+B^{&F03BzewrxAOlmE}XOGq71l_MbXR-&XxN zuzd+lI<6Hv^z^Lk&Hf-!nx_^pVA>Qqm8fkwwpHE690(9aX{W?loJT?-#7nk}DF_M_ zr4xHsq}j=mX3u8bIP=ng;lT!av>(giqZ?^db13hE-*fib4b}@G5)@-klWyI4vU-&z zt@S&j>D00g4(4E{wdsZQ`^EKDqiNcy4IMf)WWR4PCnq(dLC=ZIS$c%~d&khd?{fBT zoKCZjD=lfP8Z?SNJ^Rq6_9)&8Tjj;pp>*rF!V;%t_jQE5Il{4X&)BhW6FV=S;NXsR z_yp*2bauu?F0M!EPSvUX3E#dD-zXK8s5rsRYR57 zrOZ#K#vbh3bpv|`2i%gT5aGg-uyrM^n*(8LJ*InW>DGQchYzo#L5*R26bU}tJecnN zSFvZqG+Or9By6MWoVj|PS?f7tVn}T&vPn63|+Z%L(%J!{DB< zTB}^~sY8)GWE2VR>IURE+Z$Qkqalm#Ia04dO$ug8F3u$){dVwK7zGA{9?7gVihCjx z{|vE_*r&@&wTcyJ*lQNM7qrK$)sX1+ZIsftGqR#i z)mrtqvvVYGe$DD+#fp{x2Uaou(-F?NnYSokDjDfB*|KoiVG;IuYBF1uJ(o8w;!Ww1 z3>w;p#r?7|=fpcQ7!L9B`3>HLhH>PGFE?)8CVh!Q2}k`PZ0rbmdWxnUy3($7OQycb zOZOVN33%;8lx1kq$cMLqqBFKZYcf-*>sYpKUB&bH-MI8#>gW~dqC*J_kLB>%iM%b; zfN3*&kt2=5GV_GiIW1$Ruclw2IMyF~&W4dg2r6AeoU1b#qIa_3{0B6lez=wH%Y;!) zh+ky?YfJ_$&RMFE*5LxLMfu!IlaCt7jUrD*g5LUBejt@T=CSsvC%qdMATlBVAV~v5afS;ckgYSh@tKfN;ykgaSW^4 zpIR%{kTr>D{nQb}h&&j>f(g)T3I3?2-k^!(76yo&y(5AC?{IXnAu=S8aBVDsK?=H# z9ZAx^{?4rxD^`AStYZ8pBlhJ50$rWCy>vX+L)>_H^pFU(wTw}$)lnb#fdK@8CCI3*JNk-e1hiU8hfdz}FuzA-7Vnreu zGUt>I5OM4=>2-ufhH~}LT4v6i%M06_Xhr6dQOFnl;WcCiENEiTY)T|f> zmM_AWVw7^S!(^i*SB`j7AV)?AM8AthrxOA}hyl^*HygJ`+>b>ZYE=%Qu|X*(d76y4 zi?0SDFqAqy;c649Q%fP>m^2wG8&@ji&&z@}o2fr(6V7M*a^#Yca{1EXo+ACHV`bu4 ztxkh?-QKKPv5Hko`(X}zVKGd?V~wOr6~C&hbBdJ6V}#*jaw4^7{BUHdv|gygBgFA~ zq-mrjF>6wJ(I~4sQ`YXMVu`Alv{G4tT&YC&(I0*4oLI)-UA!rsJ}Cy7ob)NheK3R& zU+voT$WuU!+kr%9pE6rGoLLnXYIxO6SW+zXkJ% zJ-v+SOEyt$(0uX;0bI3hbzDRVTLiff;%1vPwCGq<)L$b-8`l)+l%sI|(rnx}o%1W_ zFlWt1i;q@F5p$W2OY9%@%4Gji&r7MeRzOLXF@o7asyji)y7!6HwAScdHcZ+ zpVuLl=go>0EB{+q#rRLgj@ff5F>E6f#*Ag`%vFp@cZFel?qf0uQDD#!84*Lik_CCT zaS2ae_^^EbKC+gmNtyi4tXzMRiZx1;%keH}WThzJl#u9;!l)PGNROlF!Bh@TpA3eA zRdR7|;WCbH-oU*V0iu%0`1tNEtCk;U->UK4cWF%F^hP41H1VTaLW~_=GMeWkqkKVc z0$%x8L|II1ybrcsh_om@)Nk36ESb_#uvBrOXI;pU+6{GVG-^$}T>3o>x;P@EjTCHJ zmVFzJQ=&$0Vxl6^>J4Z_`g+mzsbgZqwuo%h5gi#t^5V_N{%|gf_U&Tg=*DdFi4dYU zF8<|0LHT;kxVB~lN!yOIY#W4#-MH}($F?tF{hLCx%qWDRF_Qg9o}m$G>Lqn9%gxqh zjp$jeD{qCM)WpOJF^w=XG(<$lQMhzI9;{o+a~~g;EI34t(lx1&Psxf+7pYpK92w0Q zxZ+TO+#W{4Bcd(G8ifc~YlM*2sf9rkU-~M~QVebAOy}VjDN?1VNOKv_MR_h+aG0EB zYg4C`8{21Z;^oupOkewsN~OGU6dLx#!HWb&tBH<*;;l-vd&4P8R?S6BWPDl0iNCUJ zRjA52#%$Wk(i!cTdgc*IlMvF9@46x*4bu5AWBo0jUERg{2U)0->H%X{9wA4OQY4eB ziBP1cVfvTM+;EGhBF?&d>8Y1XNmNt}(jaG&ByQZle4OCmI6`0EW#fTk?BBbUj)T`x zfAApO^%0h9&swf5w>E4bSJ#>-Vj_r>Zl2l5^`l!ja_Asi)=p&2%dB*&o{^}CFw9B^ zQ8F^za&)7j<5}jO3#4@wPqxh7#>*$yn7ZyG)f?2Nda|d?+IX8Mmv^$^QAX-y7e=r# zoD-)Wv8G3H2A_4HUIABjZQH_|*i`iG?#$M0mo3u>{x=~RWzzc(HM-Aa;r#h5n=z0y z!ZK2;4V3THgQBTy#eS&RwFT(|9&$RuhDv2}@>V>Cl?!L5aMQX}ui2DZ#nW2m`_E9e zA$5u*N0+Pwv**oc+N3G;9N3Z@$~fM;gvI_DpCRW1Z5lRca1w?9yqEsTt(Xa8 z&;ynoc|-Nm8Htgl!aJh_w=O)VU>R@x?p(tra~>k^KOjZv;<&5dvt`RZ^sZTH+qeqv zA6y_dRcW$$h-XgwmaX$Q@WC!M1u8b6LT*>yUOmRaJHDjOUX^+kg_WXv!`8VQ`Jnn7 z=i#;Uq%2St5A#R1>^e{3s-<~*^f<3Ik`s|9#cI{TJB1Q+^gAv+)Ka=c79L-?LHaU9 zFur}nJ6USd8GYG*`X;gBQtdr+)3{*?%gB1*!;3_C6d`-cc)=X|;Tg}=Nhz4ci4&{l z^EAR4_kvYvT|NV7eAzO86CdnTQ&{A!TrO7vAD!gb3wykihw7 zvR7?Kbx~$&VW9uFVqNsd%Fm2-(VriSr00Ih6*v_NrKJ(nY#Ml+*-FR~byNy*4!Jb6h@ zG5)8`R7}mS3AuNec}rKbW%Fh>u2{;h%P$iaaS$&AX{3JAYef2;U^^_4a4gBq)ZBtM z*S4|#_%rP7ZFqfo6Vo#~xs?N?5h+b68UPL}7kGxML|6>39kzC<^ zZ+?VyCSBuX!PK5wt%ot$D8wa9=(h0~^`!|rWMuwp81$&((7X^qIbiZlf1cIGq{#xKOS?4I*nsS4^aZBf>&4vvtDB#*`3g9$SMI zu5J$K;$sL4jg)4W!pzbUcXwN^Y@Wu^@Iv%&QiQnhm%IpbqNG2ONr ziW$-XA2W!LAUHBk2!G3jrJ03rmwL37rWS;~IKYgZT9(gfPkh)z#&#V~{$cZIn9Z7? zpg>|&dTgCsak8`E{-L=X2`|f-Hl7?lbPu00MX|MzX7~suELwx9wY70TkF|}pv1eVO z*AgA8#>Up#7~i+>Ej{A}3KZbbp+m-=ajEw#B_q|9%a<=xzI^$g=O#`;NJ2ayAi&r& zkR?l&WGGM3fHXBhuhWt^<+t%G3!-i$?aTZ(knU|88yoK3yN6b*{oQBizp`iiKSol| zxTB+^EPP~A9MXHQMT-`4&v-JCoIT@zLX0a!V&KSv5j@V^jiL3j5F-StkR;gHD>yi9 z4A;!^lG9O1_A=G5da{p$ege*ij7AObZ>6*SXq!sLt9{` z7Q$UxAmZgAW^9jT_PFLkoNL%Oc?i$E2GGIdAxlm?A&aXiuOgi2+O0Jof11squyTxT zW6R*4+vz!d4EDjdSi0dLsWPSKL$Ct-=vNeNKafIc?09v4BRl=l(Z6kJwDI32M88Fh z`}p{h_xR3EwX@&hk^+Qie$Eots_iJk9@FsWN9 zE^V2_!O${H=-@!F=1b|ka6Sd>@6n~p4n{2-&y%$yxtO{&J0F?&BSX51mEb@iVwTeo;^dSt4P8n{vKg;XAz?bNl!zpbjI%fhp(G=d-2A6)#{Z+pf=4DLB7dz(UXoLc z|4Ey1g>e~UX}R?;A4<|ssVX=*r!p=bu6gIjo9IyXteV5TO&3vEniBQ?4s*s#}A`?Q*R*U9Rl&w+LOuMn#gDkp1IQU?$rllFKQCfZ&Ota&jLfq zkUp&lKL!&^OY#&ehxWNI{vV!jFVc;I>77KnzyFI(dQtxfNH6u2{$iJU?0=NEEIbMRTSxPAe#CkqB3TnF!-+ZEZ+ccpycFLrG3d0|WbmeStCn=^+K;A{vY|G$!9gEGSd`vqUmp4)3-0f39rs0A#9FJ9T4`GJw)v=>3yz#R&%^uoICuUU)|s*r_v#K8 zE}Z1>nFr{EpiY~k0I|<5aq7wgVhlPo8lBMJI#ls0qwqBdH&uK*YJ)Y!%9h~K;k8`6 zdYOHvZ(*DcF)>{d(sIr!tpaOnYpjHD*Q(=DDLtrCEF*{a?cn>L zOL0j{C5!OmbyifWUWI!HR&eh671nP&Ml6;TE|QCj*CVM>$rGLW@9A-UbN4haLXvE< z<9O)%6ty;-JHCEj<@cW@mg|QPv2XuA_Uzrm<)_l}lD~zPXE%L~OGAG~6~vvpZ;AZ) zoIB4xB|83$D&j2-{Vza z(qI}DXU?A?`a4%4P4ov&AK1saO%WWQQMM;nTimvYK0YT227`D8a;uZf`quSpJpSLnyYvF2 zFO`wlcvo6?Z;HKAT2|bHHsZInHja#Cn$f&+RwBZ+*4q|RT1x+T*St4f^^zCIS0!u9D=J1-#t zp=8XT0~_Nk8Rp~@B0arc#qTW2_MM2OPvMHxpLQm3{}qGUj3XfM3LVMOpO`G||o0_2djRww#>#G<% z`B38CpXc?dd7^<;g2SPS4t^UbR<9~M9!8?jszj47dDt;;4F2NpjpaR9cs!v|F?UE! zrXP4Jt%m=<`4iXl-Ie9^9lnY1@DPGNyk*yzR?NDTlwrYdh51E2zOrr%$3KcPKQos~ zRf}^XBEen%WDUjZR$=$^7!;a#biXhO`(CV{){di3qIh?41M4paiHL8|u})uJeu^OE zlRxA8w`c#;KQKE$^c9-6Un-hD-+&>I>67Oef3E7(kWHfg1_yoOH0(N2Sr>lGc+P*)!vk$^}<@3)CtdsnTZ_e$rxN>4b};IU21Q9_igt zCW>L>Z>18$^CK+17)>T;HP`P2Qng_N(%Bf$8DE+Pl;-xNad-HY&9F|dz&&F&5pQ-} zY!t?HSlGFcIx(&^#<+Aw+jV<4k-i++@bqvJ%@q~Lx9%W)>AGZgHWT6eIW=x)XP5Zv z*DPDMjJ9pt8hi64VtrR|R9A<*?@yAYX&q7tF?(S1O{%vjz>)p$>DZwn7uQc_*TGwy zd>BMN=Qwtp51~NL)STWdL`asx*oWTWpb%s^v$`3>{9Z_P<<+ZKczSvY(e#c(yFRdF z&1AfN3R5udG`j=SlP%x^0jcxhW*NnhKP#8@b z<{~i4ii{2_wl7)Afiw4U&0Yw*SYLj+9En-XWlr1(#mgrLX2f%K`$4Y1xR2j^1=&4a z@jJhrV>h31)Au9!@@F=-E~BENjCSMB&dvlqy2Z<21Mfm|Qol?(j!c`xb3<0jRI7<| z*n6CFWaZZ8%{+SZh%K9s;FPB@?lvZTynTelYq#<6eI$kQ=HU9lja<2XpR1RBd8)M` zZ@N^(zq!i(7f~o~pW@a#KlbfDNJMHcve`VRd&@RFPt$-B+8caKRfe$rW7%b>E8=gD zDFGZcJa8n8uDNZGq0NO1Mp>LCXoL)7VeMfvb`QRf3 z3+BW^#JzRqOio<9$3;H_CA}P&)~z1fLJL#bC6YJc3O+^Up>~Nh9GX6bXKGK%)vkkM zus;r>tW4hCV9|=zT)O*;oP`SzaDJz_K9BHy7(-rVAt|cO_`@D@wP5vxSM8Cey;?-LSc=UuTuN>&w zE)V-RULdDeRy41#vGsba@Ry2f2UoFr`yrw%J+S+5h!&kEleI~6wC4{~dHxcb6!W2Q zxf)!VJ`M9m9mp9a(mZ9kF)shu)Z`O!1>f4v!nwP!bg{+K!qQmZe(xD7-8<3@KRb8s zq;>1oiLSqm6yBeCE=&HUnLgCwd{Z+sG-|c+*(2MN%E-vb{B@+kn_rGM{9gRU5DntN zuQpEWC2f*Wl~%j_%9LA(cIky69oHrv&?cTEy>NbZ6E6_8Mw~0TNiPl|x%h+>Mp8NwLzTq$ui_HIU7MIE;iggP zDbb)Kr9ABt?AwzaJqyQdr|FWeG%Fj!nw>9&n>5>b0%n%hJo#x3lTVw{p???hg`c3$ znqBOkHIaCAAd?34VAV}{bZ8w1U&bV!l}sp2i3xbdmZN7me)J$S_V`huLQam%7{Pg? znb- zxfS>C-6BirmZ+|;VbzTgt}pD*X>}&*RIkkI9aA|FpyKYfsm#A*LFwYT_^l3SX;r|? z8;uL-=rek=s17%2(RLpB>ej_9 z=n$KphqH6`Xs*WPrcR~wY#cUDG>>4%^zrzMCc^OAg?U|9n zxie#8Va=hLJ!v!P3L_@AFs2F3Gx~JujXq0N3UZEa^M#;1G@ZFuZRs?i6WKl-V8FUv z?3^_nZTuU?4(QJ2yKraU22T3jVQ}j{kgYmihO=~>{}3w&JN$i5aO%_vjvPA5>O&7` z)1ww|_l{)l4SQplSpxPkY|RCZkM7JhyNYz})_~BR!&!baioDr8$)7(TW_lG_%QwU1 z;Tn;~0JewbqGKs%6ov@ajGe`M(HQF2YB)BfYLMIM2`kS$;O3SoEc11wMsY_5x9EXs z^?vkhR+t?V`ttaVFSUEFBvUmZ<{w|;!H16wZ`W7&=|j(^Mc6T>D_4{`$&t>De1-Cm zJ)LL-=Ms%L(LfJ>bB~?J&v5+kK4u>cqe|KAoL(`86?dFPTn-Fw-V@WBed*bxFx$uX z=Akx>{%t0Zu2dber;ZfQAw4=CFn7{gqz^K24-PYJ>m%M>TExWtFR0g|4mZ!Q;I$zm z*|TKDD^qH5-%AZ|5$CZZoY=I6;M@hMk}8TpE&5|C}H7n_yER8+f$%$UCB$c}><_i61v7W3% zKVkdzN9-8bk0l3gGk@7u;b`@FV5^B}l|Ar%PQj+laI~|bcIzsH2AEK@vJ*SD?4V@# zVT5g-$C115X;7nB;#tXs0<9{BcW+4_vojE5>8~KpCMk!*RyvOhCLBh%nqehbO0 zD^k}hoIMxraqNkjwuQ2Sr9JIB)+L8e89Ekt&*|spWb|+)Z&qtmaZ$Ke=+C2*O=(rS zH%YS-=gd=)hDAh!vP=Q|Za(MMgSQlJ+88?{Xdb+gC#?5;HBCT#@%brGDEe&Q)xe)Ck*6-L$mcpfRODZczab549 ztc*(n!#;b zM>3jz;%sz5I+ae1eWv2H@(JbgTU#=^ry@@wS2DZ0lRk5HkQUyGjl%!UE1vniqs4*) zRCf~%b~77lHmZb+hlUH01?W^##FeQ8ZHh*7aM>0frmsokqB+P{qbZi6UKzyIwNAXo z7S=X6IaqV?*d@xgAA(ob0*oI#ixP#i;pi;#Z)$FA#0R~9!~1~O?A<(*40VTKrGLlS zxI%O^##NHmMIt%4

|LHlk8qH%!g#Q~c~gGT$HR3xvGMTT0txeq4SqF)m>+nxGiB zziC<%>1F%(!~|EjE+%`YrEHlqn~lfL&@A#NPJRr>M6VO+&>5$HOq<4$XE*K}{rmae zL*br{s`+vw|LPJ8iFBwtCJm6_;c5-I2BrZ;aUR+1DDxQE?bB0fz&%&OC8Q!QJpHxC% z#wPUat5hl>@J+~>GY^GowqVkBktlU);u6i48?^7p znQ7fn6d!{$GraT#<@!^pQ5ekG$2L^*HZjg~9vLl#9ZN26Z_<<;%Al-QXgl^en3Iv73mm-48&rR{Li@?dd5!=@+BkO}X%sd=ScAj%R(a)vlO0s1z z73ar^yol-~T`LhEx_E3e6l6e`4)pHbi<;T(r4!JqRl=|MVd6yE_(xnf4xWhM;!{2O zE0@Iah*)_Suuti5xw#h1UV13^fVY zLi(WAuxC3ubm+m-eVe&4t|QTU7c!|HbKTgA3g^-@1zsidVd{64q~Xf)OYpykWC~>b zvMX=$mO?gpA*vsnKeZgb%(s(dtNDA2{+v2>%D5cUXL;8+=P0vOO4!+AvvvfD;zwj&;CXUqWKAsAxPBHh0Jrf31=g!7iobqVIz*0&U z%$mpLC!a9MT7U)P2Jv7)cb=A*PnSYJoASJW|K7N0inL1T%VW#g8B&a4EuHDzb}hGUwnjGH~3Ui}UYkDfVYq&C5?Yn&T1j5Rck}nB2^p6LUMVu4V zB3=Ktbgw;;c1ydkcjQ6Ft)GDD?JaaT;KqhA*_hsOAn|Dm@aT0kBW6#}l(e%t{_@1T5Tp8O>ToXa;)13@h1Is2AVR|v6~~MCmI>Hf$V3#F0rf*kE9K6KC$|%G1BGB|X}%X6pLM zT$wf$Mg3m9Sh$D^i>707bSc9(p1{n?kzO+v5x;3LZ^|v8t(Pf*r{^<#(PP}RSrKYc zk!2GquwY1EF8Igex;6ADjKgQ@u zO*l078sk?C$M}IIk)yM^5>j;ut@4@h@uzu=Sn^baV?mf@MV3ye&69&un7I8BSqo(6 zwSQ*T&u`7?{=+l9@ovRXCaTGc4ZpFRd zaw;SavsgE*8|iv4#{1bKk>)43iMYb8DzjvKO|CBO&6@KjbnIUjJ6m^A-(r9F87g%k z{Md{BNWE`AKhu661(Io{{%`6u`8$wI>$Ys!VqED^MkXa8-ItOrbAtvAj2&1q-yf-r zQ_u>WGJk|WD#rf^Q6ECF^GN88{=4`}jHgh(6ywRk8{h2=o9)Ne&BMi>j!7l6k!g<~ zt-ixp*~ow}?9+VTl~{irriRc@TAWi`CGLMuq6mw$#mWBvd!9rJKX$+4=UWirM2T?h z{)T6lLBtjPbzFv+FjOW^JbQK*jpp|UaQ-M_T%j<<%IZt8sW*<7F=%3mj5T0mZT<~{ zT%=pCA|@VeZ7lwPfd4fLr3t1cQg8IHO%f9t2mimH?};SF*Q{AXr%s&`U1VfZ4l7r# zq+`d9#;KZRzCXz+#(zLF6`3UdZXqrshD83$1&sMB7f8{4RkUOqqQYv!Y{Be=RcnZP9B>7(=-vjA0SaMA3^F5JTt;trNR+$(- zX)1+191o7&jSEE9O3REbbkF=iI$>eHnTob@V zyf&)}Ot?w@t*tFl3I~O$dE&k`mgdsEst|q> z_Ko41TZq3_#ubxoT{4g_cRH-hB)5d)R#w);KHW#(F$b`;Fvrd%Bl&W=VItC>Kt#mC2o`Sa%+1>_(3ocvGm z?%g{wWy)k6G?LPg8Vb^&LuoLJlatdAQJykCCP`)|K|w*rsZf9K8TuobsVGgX(1h%z zNU_x%xV{NnT{L=22f}Zi<<>J_&b{lvc4O9|)+#95b|_t|lOXr039apz}dl?Pr)(tm_HrW!CRE= zR`;v%HNWKc!G$c?dJ7E^G#tE%`UPzgkNi27R;i5D+(Wd>^X2FZnSU#*R;{8#hYqrt zN-~k0W-786PiDSFj29?SfMdswkveti6e)0%km`seD9)chPn9ZFi~=O3AvI_un{jD2 z6G`}_u zolOx^y+15|a;;|ITPST`$kk zuAyYA@)OsdZy|U?f5tp6%gK3V87mqSbq6dUuR|<eZD->8I4q%*@PK5tGbRe#_54y-8wRDoZJ?DZM=9?Z@7vdqE;e$o^QuG_NYAmyrW8u8nELgIf<%61HWoCkjskr~69&qfWFZ&ixVDQq@*qa6t z5iN;&NywWL@!%|~LTxCW+6w119=Iw^d4BUOkFK9)SdZ?UdJ;rbR6O1lYjbWwb()Xg zPNtmscyjIx1)KIHr;{c53zZ~~rwiV7>*Aft3JbG@XJh6Zh4A)tBuBI6xW0NpjHwM4 zmNulaGR4Zm3d_h_yo~gwYUjYN@a4gq;DULGomK4bk;d~jh}#rgJcGji)yvfGqG7894fX(b#57pZuoO&%~;kv zwxvYsU=}UA!QBmGIrt(Kty`By_x>r#)YP?&2Pzlw@$S2k_=PySXf)2*PBtL zVjc1os!Pi(A9?)27>YoTN^Op{)fXv>f5s7YA=;PBM59JId2#I#N{dXiXBJq;gEW4#|-xoe(m~Syoc` zzeJ}Mf=u@px-P#L$y~Po6jE<<+O%nnV=I1cyc&$+S0ZVW80n8u4C~dzDGJc4VQPl- z9nS0-QyD#d6FSR;*;Vu!HLfL_Q&w}1fs^O3bn_8nm3s14?TEwOMGT!ghhc-pbNa~( zHcuYJ#O23{Q(920LJ7R8w#Dt~a)!@eK(7HqxbQF>b5m*UUMX%#Lz@xt?iLFd&ZkMY zHFO@;k<6a?F?q9x(NkA*!#@c;*L)Nog09e}`7Bb7rS?M_rq4z54xMS&wiS&BP2!!g zTk4mDGp=EC9)D@Z_UHqAZ@j6{u+=aP^5_$^X-&{l0PJ;;g&U*Z#?>Z_JC{Kq@ z9ckOD8ErfE;Q1d|j4kBV1A@d0|LsrHNbgvXgtc7-F&D|MaATj}C-%=@!n0&r;O*MB zA=GO;l4rr6@DEN{tm5LjNi=KInl=r)GGg@^qg&|f2Yg6al=Y9H_or>$A$;zH{05>g zETh?k^8`QIKn3rL31!=|Deb!S;Z^cZW&O7z*^>V(#Kpc&g_%=1_8gjtwO(Zu++<)WwI|0~Rr?Weo~=7p8HG+E@r-D1{(3G3nn*2 zr&i;TuO8zEl@%{52fVyX(0j%zI+jh1#-adgx6h|+;hf|s)s$gfeQ4Tm3Ek_Jqsh>P zjH#6a)9m$GGPN;U5srQSCM=oK01a-e+kTj0&T7@iDdXc^V3<{Ygo*+oqbRqrozNbxt7Bp_yjBCn5 zES*!IaaHTG_C+@OH}b*WGdr%*tfb~HYZqby@#1 zJN+6+{y7;o2W9%XbfhUDGVYFT9Jkrx)-cQn`2kW zW)dRunF`))qiB=cT)sBl_(@kHIwX*2ojLBQop^U{3IjHKuwzkuLgOrPcCa-1(L_ZE zKhh^(C#=m8FY7ooS}ieg;GD|N*hBZ_qCZb}jipliSv1=f!py3cyxG`>Ol{7w;>KM% z7n1t3q+X_Yv_gc0Mr!cza7p}ht>M$hV9ab%;bdo?(8HvTM_PH`+F8VHY{qIux$Ci3 z=+TM)Lc?Nka!ZXladaq|i&~pslX_D%PUhakc<-xZZ9J9Dhb~dnM7?EH8(g@p`?a*t z;_g!1-MzR4cXxMpXp0l15Zo=eyHniVy%5~p<)mldeeU`j8yO>Ochx_COQTm>CQ$+TzFYLw+m*JlGUMFyez#ZxenuW(`_UlrJ>C=EhE+Fi&eiNfF z7=Eu^YcbyLl(}~AjC^HZF>Sv4`%qErf&8hHd!q#Nh#`1B+=Z1q5rjoTV$jXJkk~Gy zU6VW_jWbx3<1}^x#q8o>J8&N^F6gR)v;9J9O^T*wz&6B3m0ppfXEuOHyuNO<#vP~A z$&M*{t?=3t)qGf_MM8+krk;SkbM$9-eP!TFm_%{48z3YITp}$c;G-;RY)q=f+hS^) z<%HEM7F4bJtXkM(*C@OK;8Xhqyg5inY6iy_7IEZg^kd)<1*HZdK&^J4!j8jvd84T; zQZ!M6WADo4`5s}h!Zn4RiOfg8<6 z5b-giTeryK2u-%50Vv^e1XG+zh7SDZOoy?>Pcq7%ez_)!mi73CD~0K7Y-hk1!rB`; zW#3I(zsI$-wCwsmW%o2DIC!l;dcbM~Uk8h9I#b)0vdVvPw})0ZnE}|>IBh|NpT56i z@!ghG$X=N&cmrMFuo4ofgJjqDYb_w!`TmE@(>4iehfB%7qw_wHYXvN2YzfjEfl|v566!1$yOF_Rzo?%7zf7G@3;;c<6-F2#NWH zX{J-w_pJSPe|q&l1)^0sr~0p)d^co9*P>{VG4q2JxN|j8G-dyVYT6hvl=(wir|rjZ zLy>GoR-WGo@zsI&g8Mc0le{s^2YuDvI9_h%#pB;|dL8zF3re*~OpHot3?GL(XTAMPJ5mV0`{Wv^ zkS(Bakx%Y+wi-zbqMB*k=WzgrE`bjji|3sQ5iFyMlvj<#BbOYjG66+D$x{VRDUF^MFx~@8o+#IN0K$A+cs71sb;K zGgLEV5rNT?@Z`!?)LgJpes7Gs=h>{hY&DaT{Ugih_x~t6^xyqnkq`_}@^ie-dpM0h zgKN?Wri1XkLwbb9GFV?%nIr9cmEug?gu-x3&IMdK6op*J|AaH};lAN9 z3pXd)xfG|*;_yhsfmI>Yl6E>@4mtkRj=dJI6LjD zE!37+N~ukwJk70nC)A+l`8^xjpW|EK;K^qi>nc`wPxtM8_lAk! z0T{_@Xu|eHIltsZ?`=79d0%LVoHnN|m-h*xxDDdK%{?A#;>-EH(-|nK!MAFr(t$Q^ zQ#z81U=py^b(0=qhd8XbUfYj1(}-(xIV0?Q%PD`S8)YNBZSrX4NL{>UwY#oYA&Q2;a3Y9vs_USV9){IBP;pld&?OD5Wib}p`0y+)H z-F>jr<(=5_LGa*%IWTX@nA(yVLs0s>*x9Clj8dg2W&>89EFF1V;O?_6fZx8q(41bI zv8OVgl2dtl8qTP%)f)m`5@fDSSY8BNFIbV4@9|6HP{LhyR*Ms}|3sm(UXmDs>|@=?MA4Fh>S`juSdVJ(u{N1obuw`g;Fcvqi8sHL78?xr zK}WLNQ)0rm;S6YptBEnhC_`N|Up)_XzjQm~n}gubhO))#*C{@>fYv{%ht18%Dpf7P zCG`|7R)70|RKN;nS@@_+YX~G9$2yS-)ctK_WGzDDF_=f+`S%F8i~ufD=1D47Ee8nf zHiD!~ai|rNMRV{6(}+vy9g4| zf-Eh_T637HL>%K|d}ej7!4=oOexrt+^p_rPjZSHGLNmQ?H{VY+a?|0=!*@0rC!E9L zV{w=eDDt|+o5oyPRqN@F+?mk8^VA05J-K@=Yov#CzBUkB1@{tpyuiFV?$(@ zmBq{X`})R_tQTL9es5JJ*qsKlyB#zNXbVy0A5xbM$iaRGWJ9PXNw(D$8F}686~g1K@MM zC*7>Ix+FWO?r(E9@+{hBo9lps2O|2Cxgeg4DCTd2I^~CD-+Z&W2?L-QnSpzR17{+2 z5Zv_6w(-IGJ=%xmyfyjy3#IiQ4DtdzUIR7V~f+O2Hz*Mbng1XS%yUoy4B zpQJp%RWof+ykOFgXKukqNV!bD0M0N3=F&v>^ohLJE(r5SX_lATu({Xyl&SBf3K_h6_K4Q; zc%866%O-90=dP=zH6zbIHR?IpDQ4>ROm2sr2zI2%xWlV@t|PhV5sA#Z7oO-({g_6A z1vRP=&47{jdM>30h%!dQBIa?4rc-(QH);>8zL<};);S+B&@r@qKg2lYQFmg;AZVHG zax{gP>658895HN}llPYs8`YR+GxhglO{%=b zn|xk}HQHFunH~OCu4-v4cJvkddoOVm<<{7pSDyYE+OJre`V-3pa$s>i`($Do6or(w z=^OgS!v$e`N3affg!(hk@$hK7*v(Zi2avyNYC`?scgKga=A8&Cc+|<`%?tyeRHy_f z-02^o`oy3`VSsGE!@tq5Ws*A|$5%mgzA^Bd6-1vqIq7off@|>zuQJXL3a5!luId@u zPKA~4gA=`(Xy&K9i40KeM2GZU-bt_=))v0^Q)443Iv7gWr=wA`%gva}%3qA)1cyqY z6{~LR_aW%&V>)h>T{?xLHbg&^4c@O1ZQtBs(q`eXtA9Bcm6zGy`fhgtM>eLiwPmC* zv`Q`DgArxAK)7@5M0o_E-#%djJptA8yD%Z8;fldl_A;Q6c$BK3i=iE=iA$;TgBZRG z@;kg)jJG4sm{fM-+}Li#gsLKG=9-^+xBj6Oz8Y5+w|_zJ^mYPlri4M^!t#+Q#&?Mo z1%u!Eyohm`M*7Yei9bjFbzo9Jxq@uKeST!uK@Fm>ME<&d^ro0?l1$1tP0}NCoQf=A z_l3Do0XtiyI^Q=tm*7TUlm!{!pAM^5LVypL{2R#UU-zFv zbbr$(Mxu~K)t`NZ5dpVej4=Ni(_Z_EZfx+z2I#()gKIu_43&yQ$Gmq#jd<+?!(|U; z&SN$7eBh>b{kZWdjw+u3?ZX?59<=@X%O56H*m6YWf#ZS(m;7)|4>F0zvQu`5$;nyF z&OkSL`$CIqwHj@0YYO_|dqNu-1NFUM9w9j3$ng0qrnzl47rREJmY;w2Z`LaAlCd5y zF9_>aUZ>eLlcde`0$bmwNH41N9}e6ecb#q9Qep^moj$<#5t6R&5!?{m|L1AOJNSCEljB{s8( zAEMS_VfKh5{x({R`akxHxJT6?LCEk}(@hi(gVyiU)h5W_zrXX~jHKPgOX-^&Hw&$%^JuSJ zQz&|Ze*KCH`Z!ypn2oqwf@&gcjl3IdOF!PtAfKMpOn*%x()w1S0^UBHEgBH<@481! z^d0zTzzNWcud~#{{`VQ-&W?_b8kKqxiC*4?ZmdkZ`%ndSXC!fy=DP}hJTA27hkHU3 z%D32P2Mdm9KXVfepq_0}CSl28?wNEin)3EC8ntC8QMGgAvkNs@I>bNzftH! z_iq)rnL)>_|6SK8q|hO6vnx>eVlyF3oWzxp0hi)%IWT|t*^t8`r-{QX)Jw`%=vY1GPCzGT@fmt zdXvGBRGV$-VcYWp{PI@U5p+}eoru$8HUVyNQ!c*eOhTHM;#rx3Lk){)5x!sj+FhT@ z+_IVzm6(~%btl?C1GQ@1Xn{D4M$;?ypQt6EbqP*wJe^8}x_#{}2s}QoFw;NtI`zF1 z56F{Fbr&u~pe1pFa9KrJTv!jWI+Gp-oZ9w%_941BHFv*mhDdF{4VG!#Yjza zLyRHm_{1>4Ic-Q28~Cx;)FN6Zq(~7@Hi2dYJTI2w$@lH@Z?brePoGvN-_;>ozNAAB zo4 z_1jCf->GG9#?L+rCfS=3UckyN%d|RKygK=Q&ZuG5c8EXCj_MZ_RpG)|E%6k4D)^nr zhji}Ubt2HR_p5E3kBJY#g5byGDD9!Nv)EYfi*kT z!M9rN9EschPkabZObwL7z+v?+|HAJ6(3(7t0g-$h{D|t*3-9i^)halNzLt(dvAmjhNNq zPovKx=v%}jl3j!ta&0kqbbUKlZP|k=1TLYOfWr8>qGppjl7FHZ^K$>%-mnImu`g_D zZ0ANh?kD2tldp1Y4CsXqY1W<-rmrlh9g;k^BuC#}=fpjCi?oevq%O^W>Y#br8s ziXG$7vlBN9MMK#a;^D`TJzKDYxOZZ&a2#61<7$k~Kj^uokOKD;+ZuP4fxwnImAz5Z zx)E@sxM$!>i|UiXiDQ4TT$sQ*b{?XpDa8Dg-vt1K)TPV-FF`K7vT0&}T^^m0%>pm8aWw8LMr#CB@zx8;TFLlk>Y=-lC>GumUNrjY1g;agLwmC$@sc4Gj06#Nxhoq(6p|r1Ma#_Ty zp_wg`)%9^-*?kl#dp3elfxj3sr@r*oy&~dyDyf;_sO;JfU%)DRnbXPa8B;HDH`iYJ z*$TJHdnQZ0TE3G zQU9cLkJc=HLe&fSHhZ+o@f61+&`fwwM`G-S1!2q1Ae>M0_YSLW))uP4k%>iTvz8>I&vR~n!6GZ1FXrXAZ#u{{1n zU-gaEs`keohqoXd%;V8{x;JhUBiU=f>^b1SO2plV1(&C*T5ecn+$d)V1Vm=pa=SK( z2#sm97x*r4Crqrx3Rc~*&9T#eUd+k|?n@ncq>N{TFdi)43#qo*XkV7&QfA5TIORGs z(AgR76WJd5KC6JQktWvl2DeC~y)|u_LKIQ{+PqyxIqVFNIE=F#cM%VU>}nm<{1SV; zHa5?!etCzM>vr!cGkAj#%5bD``F+v#r7H6qXKgv$!<>seNpuW0y35hWt=j?-v^P(- zf(t)cH#S&Ux6Wta{!T+SKTN5XIE$~T=)s@GvjH;5i&bAM+$i6N$R&p%?YTKi4M zUpdQi%g?7~Et&6+!@D?;&gSYTQwY-xb3>N#k!LC z30b`v(eqZbZ=?ut=`2qv>~PrimH}dp8y-tiWko@_FL``Y7TkGKr?753PLav4eqL)Y z`1TvfmJVt#e1ib&w>`rTPm^W?T+*~u1>b;2$$mi~@BOHiR1o-cm3Da=xG8M7o76QzdBdPz3eMuT@>V=sLy78^~qW6dpYhdB2^KC zWoGIs5mCN{9+WgJn1-9_Cz}Eh6GXmFNB%6?8zH8~_F^S$8`&WbQ1iDtjs1-3#B9i} zt_NgSAKAA-wm>feT)~(|&3!4S8FF+sVMf0akp*@E?)}E29Krr?mgWo;yK*S;-QuuV zSE)ZW=cPPbC0gDztajr5!^pum;xsR1T^0Mip4g@&UFJESC9UlQ{1b+X8uy2pU~zg` zazPBuG4riRPSJ2pOoy+`?jbXny1MjdhJk=-*oI)>SBc0(EZX^eY-=X<60SXsm;#J9 zAsN9A4KifQLr}}o7$AiCGgj$5MnHzNrN!`|=45m6glL;yV~RPG!a$S?&duaO2#?$S zSafU?%3=B0l^O`7$K|xX`Ri)8_6tejTxDF)pl0ReSS>1NfrH64;@qW*^D!9T*V$e_ zzJ*sWQNY}OC-Fg~+C$Xm8njC8@>wRcF$+yevCj+Lus_sB?Z|Ju9mdxGF~Q^*~yF3LddQg(3c^KtP;C0q-GW(`DJWW)!zgMx&Q z6LwTBfqqY-WX62xG|i}LFKs$>aZw2MeTVEm>k%kRWiUk|e z9)2Iq8yF+PNI9BAEkL0qD@z8u4atjmn1R)QQ0|YYMP20P<3p|@YiViSujWA=e5+fm zM*XN!6oX?edvN;OXU9#YDPKg)C@0dZL8lKa@eC$W_JF?!B(Oq5UM(-h*Z6y{J-bCW z-lOQK;@!OElyh=WINPcQ_vcMK1k_c@I?~wp3q)f0kcs?dE72u}v0a0D8kY*vM2R%g>oLX93Sno>~&iKzrz_`GchfcKz0kQT#u zSFydJ7e^K~XJ3fUVzKyVRK{9E>nm|#;X&#Lq^5#biY7ziWN9b4HMEzj=BTKsG2!Up z9Fd>_8AjU24~gwd%alvIZ`h+rjQRGfjROm(ul$O|8+nvx5hfJ2Pc&zrc;e~xZLV;} zWdH?uNc>H`J0mV0L~XsxC?zRe<$~5Tsh6x|oYAE?gS~UGgC-5MS*qwnn>Zzv?LN2g zii(OgMWkv6W1?8VtKI6jkLDe`9S($=J$kh9U8v@CSmGqOe~t-ov;)tCDyYW0S6M@U zg>2h78}@JgWP1LTaWZi-FGlnRH%I+BpS2)3nak8)kC zaKc1K`sPL>_6tc_yR^KmRYpZdvQ2QFot#8TelhG2vw+8@4`&;TKjK8ljsDWho6J1{ z%ZVqKnD6}+Cuuxo0=(~|(_|g&Zinl!EEhl8AF8t}pv7&&W$7SHp*}2hQ?CCbcE5?$ z`;dx^-NR(&Pud(^B477pg;aCGkzCRC;TMc;W}qTot+^9qr#q-%L^mEWM&-QYXYrJk zOCnSE{)B!=(uER?P`_&=Y&h2KY9rNr*!md%#V7p-DZrIlp$ipzg0=rp;zHU%wGtaP zt;`k&cKM1+WKaL~b_Nw3uO3zkn3>{5>#Hzn0lh}z0+OqXQ8%VTSo+mp4OIIl&Tb)A z9d|d}q*U}5IWG&h0p^~#MnPK_`)S00Ru=@}XMDhcUdR!pYK_O7-^7E^pAI|26)gF% zXrUkSmcq(iqQCwi`}$?MItFhedH?BL_q}}0Dbjeg;0et#+B)#>!z>>NUjPf=^9+Xj znb8OMue*r9CX^LxaWmh9;j&?Z3H(_*esjxDp1B|n9tA}$O zv9Pk^jGLh~qF!2v`lhEGv^4sn+$E-Mffmp!tSDuy<9*^O3pi-SA*#%2AsW~}Zz@(` znhF`E9rL<>C#Y|2&h=q}MIG(j(&U0>3T~i*K1wDQFFj;OZQ*K9JwY>S!Io4r6g_C$ z1~vk?;y)}3W#eEor=GXpSVP}kb>0wF&hyQZC@RuU&V5tnS7V*`8<{nUJIP${)|OHz z&B!+1VXrmLw>Q??^je&8+RE{~$g}(>v}a!}yPAh6ggZMsF&VU`phJ-iaeQZ#zoS|D zr5V*B<%1NgQvm&n7H8qYW-)FjhT-bJ)UkTJccFujW@Y#f@y*Za2f-wu&C6^1_OAL6 zYbjIQIWm;l(5S+Z6PUTlO9{02a%tiZ3p+D&&gb|3Icb}#gJgs+NZ0Q zi`T0M$L&os_DYT#QH=JmJo83p$gYAN;s>wYijnZ26)iU$F1xeIO&d4W^AKWk z&UV~6JbC5nem)PUjQqm+P*t+fB7BbQug7(`u0l% z6C1aKGVi})h^XrRPGB%h=#v_*n-p)fL%LVFoA((+xfYpq^4Qn{983Gl<<@|)>(i+V$j?94;m!U9oS=A6lc;~Njd{I{NJ0ESuK>aiPP?aP30O4SpTyKAF4vBot2S{yv@a>uA ze6bwMnGjCzhbr4wx_k69IY(aaWl?x5KyZ=WqxGN_KwYWbpeN@N2j%6GNxSEv&CHou zNXTof<@i#~Rt3;pT+>k9ulC8-B*_XtkE4HW27Y#k|5Hk0u7nDvANHm2 ziWg~LG$}lyPx&d^cA`XSwd_n`tt4rTV-{=Zo_+dE-~utC1s?~UYCF(}poo2b)kg_z z_NygBBJ{*e!^->hfa#n#BiD2COb^kWqOR`i(q4|@U=mMCUtspKfgAII5QH2wm`HuI zLgjOJHhu#Ri(B~hMTj4Gd*6YpBlRR&)IBqxvNN9WaW{?Kq{n4tW#ezW^M5tazxzO< zWdLRBBQ`q}wIi{Z%(AZ+d(v2)2t-%5lul;KysYz;?R`iU;##m`w{&!T7fUD_i;Ykl zblDja(bB@TX?XI?&ZQj(NVxbuUV*0z^?Zb6o+a56bJj7Lnn2IYje*1nEif>wGD!n(a$nIatR&8e1a6)?R0}1G57~DVscky|O-Wf&B_h^{28xdP^E2&%~pR z{M2U?ZgRHdg7f+31oxn!d(T7lHer3H%)*4kq-HHn*bv%n~TVz~8!L%Irs>B6D^ zB+ri|cU{U_UTxqMj~5x@6x%91I}x$@?Q>SOBtOHYp=-ugxd3CZyj`Hmd@jB=??;Z z+Z1OX``l{@NhU7D;xGY4J2$CKc7D#0#peFFu5;Oh#C$#Ld^6+D!s{r5Q{@)APq$US zWHONHXYbt@*0U9g?o`)iVq?Ittbex^8ae1j$e-hP+`UI52(rpEcl)Ov(M~qj(x zXRBt#(mw-;=n+qQW66jmonC73`fEfxLt~)8nk|H$I}I_~4=!oJ)7XO*>O}a{xA0ll z6)h??35Bt6jh6 z!c(*Gpv(D6l>-2*7{&u-h+5jIrcKiBn9@8yBYQ^(9Zm^$Ym`YgKX(FDTelQ7=uzK2( z=-HQ>^DC#G|NA*5?_ff%>b^@t*B(3UrA~E&Jm$6}oOMm%CsIbB~bN##2bY8(A;(NKM_xI3y7teAM_38xaMV!R zZrC*si|RqY0>aL|h^$1_<4BfrnN0Ph!c)4+RNo*P9-fG}_@~nM{nx^Izf6+D#H#rt z*6?IIyBEi?2s(p|nai%2dY|3Jtz&SAHkL|2;McolN1o$A z&TQUukOXB#)FYN?MxUeNEZY+!H~scqJ2fj#X9b^Ul*& zot5qHJ~v&2>ok}y@m$HjKUL4oR=xKqr=71JP{mL-;|ra?6J~8$2F8PUgu5qkej*?m zo>0GXh1 zwGE-Jfo=q545Gk+_ia5s#I-D_I(Nx0fQ^7)IYEh~)5prd$f$My7sis?uK%1rd~0)i z>?(%im;*HEnB{aWVU=h5@okZ7woqL&6cJx^u(0FtFdr4J#*x?mRVFW1c;Hd{6|ePK zWP79OBIXIqcTMH2xczdXkx;e~vDF*KTA)bHcY_=LPEu^uX&H6< zt%9$~>=^8{g)Kd~5v|SQ`Zd$%4)Svc(>E@ZsIA&>L_7^CMIzYEW=f2!GDEr{Pu=?t z$dQpc6XnvtM_o|oDaCh3+(Vr^6kCBm`1hwEO*|z|#S@C@Qh|57qShbv9CL*Vleq(d zUt3~u(^Zq-xUvJnHe0OS2>icIqXcKB$nT0!Uv#m7&hk<4*9|t8zAsY|c|Gznq`vcI zci}>HQkJ*j(84i8F{r$3@s=>|_1E}lemyusS7YHcJDf<-TFnmD^`5)PyaOYni!G>n z-?G_>7LmP5RBh6Hvd&1gwy2Ks;Fg_%-E2?+XGE7YioM|7Ru%G!UQ+4Th_`5%r*pPU z=vzDJb+T~9#h`g(B=gE4&TH{!7%+OgFJd-gAyy?iU)*NQy}(LBqqRg}`%aW#Hvv;FwBl_mNEfeNeZ?}v&+4FJG0iu_?&_1BG#T?QMddpzyn z4|i~%^%o!qY2e$~z``z+JW}+K&sqLGkD2ZjZO*vf(v|ZSO!drqf5EC_iPcGz$;vJc z@g2vBmavJ$9+Md>;{McM8WCPIKp)G_jdF&Ow;ufhmW^X?;0>Mf)C)WalQ`1D93ri7 z!5@zfg7X497ky84G4uRd=sirPmf`{&TZG<+t79-R96ovPb{y``VsNfz%WULycKl*m zongs~XXcb>t<2UA%YTAtI(y7j;ZyoU&CJzzxuyQ4=91)VRBf(!oZf&F84U3y%lGct zan)vhKc4IKoxMj8fgk+*R#M$J?M%jSct3lF>~Jgk_Nzij+&Se~J!`#vTatZjQ+zir zIw76`@n$?6t~$N(?&$g}fm6*K#~#<%#4PX`%4oz$O`|8=B*5ZHxxD@%H8_UWzFnm= zs(-t^-Y;6~dA><397eTzjh*%S>wb5J%h-48A-mAh{}M1U=B@sNvA5LO-&?V9I*kpb z=(2d&MlwOR|HT4aL+A!Av^QyfJmE0aWim=S$8zy!&3ya$6YQ5VgMi6q&rkT|4f^@aInk$*t8rq`r=5DehIz9!3!MC)1v~D&QJQ>9_6Zl zGnm=}F@~+#nShsOdz0apul{9MdGF4(Rh7f(_^XHNFBtN&3g#0Vd-b*+arUF_R-4X@ znW3KlsD_kNn|>0^>=8aRo6nDO07u zT0pK%{rjdpLFflc<;trf&pS=b%Y)%=6e(QLJcd88vH<=T5@$}^h~if0k?spPBpl2u zqC7lw%Chd{YnSi+I=b{L*PU1yeE4C-gK;=SY~Q-;4Yxmw+4zlAbwpjhf4X7+pxK)= zwr$r~+)4FGgIO|pLOn{g#-Db8#13yX4{iZB%irX&vgF2YE;cHQZiWMYC~+dwI^Z5% zv2AWQT;5_W{~S~}|MAKW=Q7Y{?7~Na#g`?Pyavfyha%zfI?Ls40N|r}6roz87n~U& zcAt6eEnFwW&mnKEK@mI*G^n*!#NkV1klLfN9j+oCf00seuC^7zL)Y{Q^!CD(PZBCH zn_!zeTS^&enQ`{ER<#*>?i;T2<>75aRvbexLc5AM*oIkJk&@DouuoGU87P{4cEQ0h(rBL1ugh<51Cp#nSkw#8B^ z0%-Qp#<$I@nja1+Wbm&a4(KwjG6rwBvT*D9_B?EZ?I$bLd^j>hq*SIG)D;R5m;cPo zK7YwDNcOKUFz!YH7(B(iO8HLBjfMew6>4&QhxtP{?pulo&bE4m7B||Cqk~W_0wddhN9(hg#op@sNFHCoz8z@UPT!bJnkdQ&nCU0`#bvc3yDn<-S=#nXmRpVboJw= zH-=_P^m38~7#HEQefGR4e<-_KV@o@0w z`OFSqQ-KDMh#K;hY`_YxT#c;shuMOyxT8`IOC>sa?pqJ+gXNfnKX0QSqCYHRfkXrP z+SnYIa`=1T0V~b8^@bz5sbs9lOYv61B!dZRG;+xHzEn;`#7v4%9K)GlwE5w}hFunm zc0v~vE0JbbhyD;Zb{Hw`Wo}jW2F0-;pvb!MJxY^obXskEx%|;3J-@Ggs8^2l9BwNWJzl1CJDx|)x+13X5ioxy+5SDeu(j3puTNTRA*I>zWEB2m-Oib&J#g8o0O%Ce$LKotzJdN%+nRzB$l z9TLc5BH!@TrG0fHJ7SgC)G?3Dy4XT3%7B9nkqkM}iX$979Aj~xUKvmNymh^K??7ai zPhPvF9L^Din2JM#-UOrK^Z+u}0$;bUXnb`;JV3kUmM1O`7>_D@DuD$5zzk$$7>|gN zW-&uXjOhF2Rj8OH*Z=hzm)DwWzJpN78Z6?ut(V_9Z(0IWtR7wnM#C!O3I&PlxqXTb ztuWg9)o&-*fU&D+>rF0R8(o5}Od)BKx6N9Iz6*{~pkWqKD<7&V*;vATc(O*Hy!sH$ zi>;NAe{5k)ucs%VdVRRd51Fp!Ce<>RRh$6G8ngpwjJukAW-O#j>$(J|m<$T)hKJM# z+#LApFcd2Hlue%ECmtJuxi|OY+#5o!h~~cX)HE4( zCIn^L+Z~(vg!47L^;}X!eDAA-bA50@9ucrbcBN#7Ru6Elu4Mi;JpV;tUt~F*2TA)9e>*Vdl zPh%^7WmsUs?T=C9JlHPj>y_yZKIBKA44YB~9dg|xa;-=q9;^pNl*K6Jycz+rCd^DW zOU7D@3*~3yIWjhqL3OPx6^p1bylMs7tVMmO1*s76<5Qdwoe^jcO3A=(j-C07q`f4KX9vqWz&I|v?n{~oTpYk*2gP~ zo35LS5inLBa)G@c{0TPP=|nnn1Ud7I>a#=&35k9;GaZ&Uy!oJri>d?$DmpE`v;)sF zrPmXfMBNUtaDhv*n*g6M7%WCtJ|5ukY?CMYB}T>AIvbvP^;7=A!G%%11{0Yf-ACb2 zldZo$LT2~2~15@%i%an|(oa9r|!!}oW_|E!URO7?PowWKKW zl=mo;ZpC`LwPkM5Ur3d$sBt3R4(pEiGfrnsAARAD%W69u^Hv$F3O$;Hs4&T+nQ!@P zAlkz^QV*@CMTR{(IvCr1x1lTa#sIJSX`2<31OxcUyl1K)UDP0LnHQ9xkPE7ax>k6< z<3&$v#_b^^k1k{xsQOGMSR&y=(Lh3YgBD$!9OK|1&AFVTidMym=B@ZeH7%4)!#KL4 zpIJ=)dn4Zekk_CLF37)3qW>S>zWNtIM*Y8JHaW`Q7nGa?$>`Vrqz?gyNZc40Ad*6X z|F5LrZS{XSY+qmBI)`;WJ3G6m4oh0Bk{Ibn@0SNwC@L+LFXMd;kR}sgU_flpiEeB2 zjbu_xB_TL8xVX6ZdwaY%;JbC7mFqJ3f2HhLIhVVrQ4^>^2%FUaIt?{CZpH)!iACZ- zRPYPrvHZ&7nCf6Ua{b-lJ5l#OvvXR;NM(8}e^IyqlP@zQJ5G zn&{QyC7)D-ah_v;m~9%=nDqB`Bn%G5l0-yD_s`C_l{g3#m6 zTw7r19)I^gpo}#|Iz#EadokiawAY?wz{_{!89A*d^#5nym=R>M4j)TpAN?he`tJo% z(1|tx3TFS`C!haJm<+ZwmmQEzIE<&1D^@LvX2;ZAC_6HPzr7juw;Lo zlNh~xG?XkS3=6ybqbtdoB^v}*eXO=+ZsBVfWXGf1807a&sd>T+!bTQrmFqb_Gasr| zUD8R7a8bkEk7u3_5RgY`qt3W^k4s4&THJ?8*5sy@qgzILAn$` zfyib=veQ6@rojKF2X42JLMw~38f>tL_}o}3*%+^1p=C@=lkZ7nm!_BDU_g2xi?eWW zW*G`9+UZ~`CpE@%Y<+M$5@zjR67loFx7Yte)?0?f6*S$VApwHBYjAgWcM0wi+-1dxYat)Q<$&yX0+ZWB zLJRPWpOp~E69|P&6-dU0H`b(7c z*Ivj3cpVNw$*OvIF+AahkY+Syw^g`dzJbp}cF};D45nwOe*1{L3LG3mdn}_OI z;oxNQE{aU#`MxxMtIz5;O_a~?A4|NsaB}Bz9z5f3kFD|;cTTs5s6at&g%PvupQs!n z4uS2A7Csm`pGgH%hRjjNRg@{a4i2W=Z}^HBvi;u*Fe8`lQ?cP3E21fx%-h# z)sk0V*GK1ap~`*o ze{>5QBH;ac>;fNFtlPVo&WSsKR?CT{Z+aOG9i7eg^t883C7ZYttWJMyjeYzsSdX`FxFqb^bSIf64Wk%TDsm+HUb#6-NU}v1HxA zLhS;2)`0~hFDp3Scl>u(LK>d~YeJE&)b#zqfqS0*2MYp0wg1MmW%=Clbd3U^{rHCE z>PFRYOfrLxi35z;QfIZaLZ}CWF0qGS8cVPU|5iXI^rlX+vo{>7Oh{jU{F3R?5NH_wgi zHnX4ke3<2+BlrF~-tg6gdEWh=7EWB6tI`@DyO14#Aj1{(V7jQF&r|5>8cpT@iPUqC z-^0!7gEn?DSFD|&9TWzS<>ZO<2kp%T*EuLP#cQ$of>YPL(&BE5pJH>hzC`(~yFCSY`JZmeK>4eK68JTxlj$Xt5&77FVtW=m`?)srqD)rf5`8GPNJ! zK|WvpG*dk7SDtKIz-q^xZ01!2ECXK6k0a7_cB1Z{Z(FzbFapQ!#$DYqv(|rq4u)}^ z3VKJtsvhKz&d0Vnf88=Ymfmt*@|bZ>Z!Gu!<7KXb%@BT0oT)C2);pg(Jdu&K zNbqY+^y;b7Y`dCCv-Itw%E@W>sfeY#4b2~v1+|~7p{1)!Wxw5M2Fccfv=h}7`sdGB zFemmEB~fE+@|$`p&O_nYboVyM`40;hW+eg1e!{C<26;!JI$(!mdLaxlxDsWenQ4M8 zn-ULBs6{)xm5!OKXv>1j8Ga;aLxWVm|EF&pr+-@T;s;W`(D9C3g?>l)1%u(afM3+{ zijd$xOUFByzF(C&B{8E{6T?dvpvX^8)m4m9iH!CKS6q~VN+y2-KibnM5;EPVrVv7-X^A90* zXo`z`1bLmNP=mi4)sK_#4ampc1HTCmHyp^bA#76JchFHQ?a{Lf=xU4Wp7IlYB`c!_ zSR4qaY42}_K2VGG;3uhTA^wQ;z;C>W!wa=zGbOY=u}2dV_pVOa1Z^%$ghFi*Ec+#f z+uZ<0m@=u{?GuXU5X_mf!#z)Ii9pyF*HHL0h85HkmHOoLHpmSZ%L=or=C&L(3K`3V zX>7T0yd?7TiuhDu0w6{!TXZzDFcg4(;aXi10bX1bQIDddPY?UKR}2_IyPDq8zJHJ` zrW)8B7vo^>{NAsQlpVAE989-(;I{KPHR6JCKt!-FQ|vpy><;!e6Ol|yAzCQqwBN2> zhG5d+Is42zo?{YGbQ27`VrfL`HDycWpE}7ecK4RD9cJEtQ?0~3)av*w7W&XTM^9Aj z%>f7#k}mnsA8+weG#PK-In7*4wwUIf>sM{>5zl0#{E$3&i-nB@tU}_%LT750BZb9AO zl>y-u;&RmBTM_(es`il-O}jlG**qiGYOX@UE=Jh%IJzSJ*h!nw>MH5WNLw;tH<)Q; zvpSa7;jy>ax0BN$qu*JyrK@tSzzA$!Mt`4?Yv|dRsZy{k!3e|!t6dO z$x~Ur%cO^;V8 zrP9#(8_ND1vCMHRx?;3D+G*!m+20hNq={BaI5QOxh z9X8O>GQP|M!euVWv4ou144lRj&0#ijwD7z??K;F=nbg(>0NyZ?%e8uP?Xz%efW#Aw z7e(%&jH7D+bXAhsKk{nj8F8@!EZgqJ#%Pk2F@|OIRleZ2IpOMjFb5gtUTYE?j)f^U#wE;F$8BS2-B>0=7??& zrEwJiHfU_z%GHzA7!6awhh0iO({7nTC96JynRpbexNqe6&_Fz!(63Az5L~Q4n{E?eD^9Itsit8i59);@PqFWJ|O2s(-UR(syCw%v^_TtU2tEFn0 zGF^(7jB=`Rc*7#<-}~i63qE^`N@PmY;g#+qb@P7yL|YGyig-1J%AVfzWdnaE&EPjR zvT+a!J+zz6=@5%;J5M)-qYa|+ z;@z>P%^yhHcBgugdjI16!JCLj#9{F!|I(bYH5Td!xBSyDEM(OKjebwxX}_EOmI1<( z>)KQvg~S66h=z4Jm8wxMU1k8oQqEtJ)|Hlqf3K2fX_gpnW@c_A^EyJ+yH^pWrbc93^|mJOM2wqas5y*7WKfw?Y)NZIhu2Zgq}bU*GbtvenzszT}=qbZ@dxN)l7de zpa_`!y)&fKj7k;~m223D)`}R`JA$?zd_0)N*G0O{pvjmhQt44CFK2LM4ATl{PX4$i zrA(ABkH**P(}-9+^o!0`&;#eYvf-G51i{sGfoe0|j=09VpMQp)bhR}C^gI!=#d=y; zFGHpTwuu%%p(kFBrM$Jm?EJ_vIVUD}IYd~oEfSsd_TzgcL>o$isFrmh^jEzN!HhOv zBKdUopEl^vjuJT#Is8zTYwnO)y4YKXK@j}X3jtPvbgZ=>+-l~^qvw1{kNK{a`rQFT zCMmInI-33UPQ`vFLqR&+Ds6qjlF>v`XaC~2u5sXO;7xqV6GbC!1oaCRf&%Ms*h7}B zvZw4886C$&GwcI#1borPkvXdlAH~kk4JPs$6(ezkQWxZw+0OGZcc||64yzb55f&W1 zkD0SA?EC8c_tKUe5T-*>)U`hOZ~477@0HBP?a5&=S4%L;a%PG2$LiOeOlO2pI4Ro) zNmu@h{pJFjr5OF$9y3?C%^67`>{^!_Wl7#_^W`H8(TCqtN3-IRy|HD&oag7uB0(r6 zU%3eTc?`8_F&s_L2-dstLV}!}ZwH0@=_4u!BSMEk< zzA4(U==j7k6oM<3-a|~a3T4ELYYrTKPwwDaEOI{$P2=DQP_!HhVn;CfFlo>w(@bj< z^^8E`Z}qT47@1R>a8S4e-7hIUHH@qH%W12y$VgI!v}W$CwDGtBWG#V8fifa69lUhT z6nc00dL2Uw)_s4)5%~_{uQ{tF-$PE{#+a&pE;5DS<=HaQzdk~Gi7~g+*x9xtRaULo z3}w;6L6VtaR3x%AK3BUB!@W_2El~k3AN?l3?rG(cy!S^9JYv%o@L~Mw zv$JmL#WiZhQAhD=)S+fp)mKv}RD?v9;E0XjB409Q2WIdkbn{0`b-^W$pT5a;qVSaib3%}F~h|5x5|zH`tef-t=mOA z;PyW5xHHedlMvF0w|Yp*YOfog^`RKQR#qJ))0q+2v%EagJxAe5Dc?}(eQXNzWUS=8 z*|yq$FMQn>moXz@%qtA$smu{z-&YWAb^{#u+Snw7n@ij%RRrbeTeu8K7*})5Rt!|@9Nm;HIQTt|Cua2DE{}Y|tr9}=eVsxdl%bpN=(?ND zPJpg2&`cA0{j;w*wYXe@oeUCCwHO`oobXoY_A-7HTsG*&eXhUjX~IC2Y8@+L?`+Tr zaPD{=QLDGc zks`R0f^zH^I*^kq-zYI^t2qd~cy-M`nm78o*3V9nrK!sKCr3VA4JvJ=MS1%_$^07w zrjxlMJMreeu`+_Er>AIsZ|Px;s>}-<5TaIZ6V2wqFD^Av6Q>Gimm-5;C8h zHZ5}^uJ6+0u4a7a9sZ88y%^II>7nDhyI+Z37X@6V@c1agX_P45*M0Df3xU)$4ca`D zs&b>dG4Q?IuOD~ct=&>G)qiigyO1DbJXtAMLO;QKZrfW(-1gv~dZG1%1s4qcu7 zS2i;{g03p3JH1COOesaejTVl!t#dr*?B<4bpc7B~hib`bk4*D8Gm$@h6KexHV$B%Gg?iK`%7i;)|!|724HeEJG!BG#2T~w$8Z$ zFm;{oYph~el8tUM>P32Ri>Cdg?Y%MFaz-pm6lN%6TY+bk3NY*>ZfZ^?Y>T%^QmBtq z45Fs+`}gwz9u}7R-gyoIOdF2ww=+gg+m>#+lp6X&U8oH9X^y)*?=Avh(U^!o?cC75 zePC49SC2kdPL}#^K?QTTJy}qJ9Ho<~49;$9sWeTUgP=-<)z?+S3)8oIx>h%afz@{P zA%kix;)hX_i8QIyq{F^VJng|)3Notb>|*J@8q={vsEO65A%@}K;(7F1TG|PM?t-jE zZlosfuk4k&v2Su%H=({+ z(+Rng2`4u9p=b<84lIPSs8lFG0_O7#qE#MoEK>H_1_CiY_oBa?nXwnfBW7`H;wb(E z4kqCirqAyl&70W@cw~LHTTv#pv0oJ}ymXKMy)7QXiQzGnm~Aq^s9bK0%UU=h+As+AVO)8O7nN|@`g*xzG?D$lwU27Dht*%A?zM5Lws>pNWLbQ>ANX}$A-qE4fI z*5UJt^xeY)IK?9^Lek;KbLl1I)|*$VG~3Lfwij1=O&a~sv2BP>8CO4997@V(XA;jG zLj9hRy1NoxY7T6!%APtkGPq)nt<|D2ZuRp1vbTZD^VtX&SdODxdslSX!#|ySv&Kc?Yy%#{C2K$==;B!kN&TIBpY_93nSX{pG6PjeofCo+< z>Lfl6UXszBb$ycsGX{nX46^4rOe7(f-mP)dqPDW}r6}~FN?<>F!s;SFPhh^dnD;a_ zPn)lR#$E=FpW$+Alv@2Uy5}p-8Ztq?UoDo)*-{$2`Blk|dcXHa8brx7J>0Zf^7{IE z|67Vwf328$1_1E}@8N*6)W0Xlj(vzxCm5Vqzy{6$>BnqKXty5n_WNb=vu^s~K{9)p z`5#>F&`sor5BUlIPP60uIPu8c<2F6vl)Tdq*`v%~EAN?{A1`Plub`*meO&D2bgd|& zgRRQ0cl@)Q!UN^VY|6gVrFD8tWTF?`tipo?cDo!=s}Ry{h^#WreS_$(Or3=Ub=Tj< zeD9yyB9@q|ohYWqHv;=sHBMd1MN-n|B))i1s4CK0D)CTNX7{mrijr7+Fq!O~-I+%4 zNCd~@YdKSGx$imgY1h;XX7MuQs~>O%8R&HSDp2(wc#XTpKu6kUVkfO<#>zQcaV~V0 z`h0;A6iU&MvrAjJCHvwYGLxr>s>nbXt{;lH-HsnUx7g;wWZbvtgz1>$k$4`=5ZS>- z&-1;DE)dseJpdZB=H^)jGO!3~v$%^w%bYC&yilXyzX*-yzkfAUuq*MAS*fu*0$h_y z{MmZS7D>cC9*7)@Vy+#LsXc}b(3jl55CxB^N8D{D|HLCQI5_vi_w(n^kt17FAe@B| z=lyLTxD+~tZAW=Q{=cDV7QT9sZr7|I9KJX#i~^up=vFpur(dqtndON%7_bG(zv^VD z6DchN4IQuVb?JNIsT`*A^Ic!iB+^fTi)ou5hp6VbH}UhkWL`0b{p$=um?P4L?9tbo zb{L%6aLQyIWbWs_y=;b@<>EVcTLrmHzF!jxelV^-XYa0`z)V|AL=_Z%DJ|a)XLTk0 zQ;W$P_*viO8sE=ITjTZaG^9&L$!OB}*w5xdHHbuO{-#xSPt-0a>X!m!7<9RPtc;9bTyx2!}WWx?rc!=kg44xwTNy6K`h+^=B~ zYOh8lj3i9YWC`)$#FT6BcAGdAoE9J`C^(wIH9>tG$&`u_Z3-PvA{KJNuR@vPX=?}bMsJ)%949b;o-Q4^R}oyLM(Y?*(ON=!-Ki{tv53#`cJZub;zzQH7o;z@F71c@?I`kH*i%F)_$; z$@E>*)6gYWdZ_aSNCq6@sDq)p?fS^S0FDupeZ1(dHrd>?#e?3vbihqww>G=@(=SQtE zl`$VnH^Yb%`rLs*K!aGyD3?LsYZi|#^YdUd4c*<{-DKyxr!Wg^*3ku2E3EZs%? zT}o82u-1i?c>1F9=H(;K@x1ZnW9qT^ID6C&RXg&d(;I}tr2ZQN9*h1PEiEnB`6@|S zNEUuou3fvmy={!K6F+G`l@A4G#OfXy89B6ge|_o?bx&c`kNo`d5&`&PzMb_W`LOTX zayFo!^E%}K=7`E|XB#tB3y1l;qYU@0K64llQyc`;r$;Pth1LXvGs444Tcmgp+#`yoW0_xl??(di%YNI#ia zkV{yd?81Xh{B=rf&c^+X#Ut-3WINJ=cryxV1v9{h@ZI7`jy#L$N?@Au#*l)iugR7z zTT~kD3@nL4l=0k5`pxVGl2P3o8#!Q>Z0G$^+~GtT6O5A$Y?&~+rmNn_w1v?$pSes0 zheR#>4bpBQTy<6_-FE`}TwTj(-oKggT(gl$<`| zXD>xDzrRLbyPm>ga`9ek~M!wY7((73}^* zfpz!nzKtS1#HC+d3XVT>hi%sephv{>uQ9E zn329YEjffq)2a&T(9m9`A}9Y8gwAt_$L+`$8@SW70JS3UL&$gi40MK9RL;s`>94q5 zV*4_%!}2oRGy#nsgD!*>WFq(aP5~3}?G;H@PHqkNlCGlZGcy0>r<$6Y%T?!zzZLZK zvvhcYy_=&+zlK>!oBl=xYs<9)9m=-hoTiV&)#|SG*X5=Vuwv`dT9ubexIyTc(Y6T_ z5)&7GqeqLU>n6*Klm}ZZc9~O?(BGAuwO$EU_V@*=AI)xVmAj2p`L)DeU~NMqQ|enf zlp^3}9z7W0g>JHi?_}9ava7lElJnPSHA=9ukI*~GvdE+B zuG3{i{KY%HpWRYvMDp!t$kzjWW{-xfY08Y3)8j-+*;`FeA)NqDR)J^%>otNqX;MmJ zBYuk2!lbA`)^>k4_l8eE+(_|etpxA55ZzBIudh>$NcAjzbSqe))^zq?xsYqJCn1%EYJD3iYA(Gq>x0p={HjU3JAoSM(qP4O-Pb_Q;CJOPBm1|P6R z0aqJdaq4Jb*xyA zo9|isDBF%u`TSI_1WxfBpvtE$dhG~xmVx=|iD>h78A+p@?aGHFJf0sBH;Unr3kRpQ zv$tCxj+cwl$fDMCD^%XUl@K~R-D3Nso)-%f;=t_l#TW~-Lu1GlJYr(eA~%IZS5+D` zmhB9Sb)3I^jW$)jahD=y1{{XVFQ>?yoi1G=e3(LRZl1NS);*$Ex|PlY8}`iAUP-)g zlHlu=HmQL!cvsVex4Ga>8rPo-HPXO8(_3<6c}a)g(47DLAbA-hWs+o^xw?}jG-rU1 zBEW=ypoW>`KFHk1asdV5;l4Y@g=_P%mk%vexqu?jew&O?V!=5f@YhWC=C8putMIfw z@t&vQ{&9c^-&0i6$Z$!E!Pu=jA~H4C2?GHNuq4WC-ZTgqeg8X8|Q^}9yG1aVnQ%YL4>Uto!QwuMGaZ&rG-U|{+2 zEB?%b$XoR8y%dL=EJ0=Ebrl|kdiL^j{ac7JVuw-|oG2V;$|r%6R}*s&mU|0Ajo(p7 z0KT0Y*7%6m>iJ9W%X!O8xpJ*T0Q$<9fBBY+b#)6KA%M?iW>E4&_UyMYUj0k2EupW<-Tp-NOc)Iu)c&4Pwrc_IS$hu>}FCs1T_!2rL7sr1`m52 zGhd3swjh3>2+;~K`lK&S9jYbb9L=u997qlcQhQbVv>PwHM)b=cx!#HtQDvF4X6mmI zOr=sYkrk3JdHshiu@I3hG=hF^VETMLdNo1j#-k zs5uk#z8JT{FUVOIS1TvqArOSf0zU2GGtONOqK%z}w%~o9V3=ffuJ;#~WZ$qkzNydO zN* z_8-(iYrTl8vY#aR**FpTW0%0%8;@Oa<@Yv|S~kmp4p3l390HSb-5m)r=$wb@r)H_G zUtx_vt&*4n+8nkUnA%7`#(kX{~`g`Ftxdx;{6p_xs@(K zjlV4j+Rzs>!{b#BcXwt(6hh{)_GG0gZTS-S_rk!2cn5&M!>ww*E2n@{Q$yaGxz zDrrBI2nsDuHew}E=qj*UM%={;O@tLT_VbJ+933khs70>Vug1b1H0D9eId#8?fn0-d$9upYNAw&3V>v9XB`&l?p4L+^ti=hDgFMyKx z6%dQdACAo-C4!>Nm0#XC%_86-_VF|cLhnO_RMNpcmPkEPxg-o#_QC?02(6v?L!9q&02vHxYq%SnHRpXV<^E=k0jmFE^cZ1-#E`G z{Ut@?P6YpOFH^2bOOL1S_1vi<0?|&j45nCJ$Lgw$K@p$kUR2OF|-1YskF@+)C!7s6ckyuctA)v=J3O|qeJB9pAn{Aq9wgLYJhSGhHd~_8#&`SYm%-$v#y`*(cL56#-Z0KRlm$I!iI7 zfDLP{l-8sescZUs#qYq&kxAdnVe(t}i~q#H3WM+&*2V#Z>cal&;Ou*1>Q{O~Ho`-- z5VzUysK2QemRwcyJZlYwgnEa4@P4`Nh}XI+r8VFIU1-(Wr$k`q{8ysaG$FUNNQ_(I zx@xU!hA4IKmZCXcZ#=<)24e!B!^&?qL4>s4S#JIjfci0B%BLjKwAXz{Gu| z?0$-_x};u0D}niW`=@#p!tZatj2t&UWeYMz;*n=I0ri-;#vyup9usahn;S_<2r6Ih z5DD0=h`RZ{yf$&F_ZZ5|@~Sa1!ofFU)!UV?6q5LhTaU2AJ1-oTC~VJ(v2Ytk7g#B8 znAqDG@WyJ^0uXyQTRlv+#y`hp#LckiQHHE=7f3=f>Fp0(A|VlFA9uMm5DJ{3fts;> z!)hoI;VRB$&sO<<#tD3}RE(;355~66FveSL8dv6r$*nn3``~2{^DMGJnRvJ}ar8p# zBafBR!|Rl@BLv6n%aTMmD(QtvUOM0X(T=(cpys|bCt_uucmZV9@03MMBf3~A{00C1DqfgZH0H{Lx;Ol zJ}m zLZo@eHX$5FjnxXRpw^G=yfn(?23WE{Tg*gjoSVR}T=75K?q`{&f&1~j-)Z&$R-rKO zY-|uc2OiASpo3cV*Bu)sL4&e9@+Hv&_ItbNeJd+Y&v~fq0+CKBI*i*B(=8!3exOsb z|0ot}9TkKO<(enyRJX?vt)vo<}d~7o*Q`A*Ho$Paw}YHyys$0*voiAUQrs(^m#~)GquUm=qQvW**``- zgELpB^yr`nAVs3j(YBcpu!9ix(aZ+1RrJZ;1=Hv@6F-I1O+deux0!Twbc|MqE2@Eo zVhw)4teUuS;!6p{8AB^u4=ClplR0&{_xtCB_`mmAzhEkI-3WQdKrBnV*VMk&5y9C+ zh!11=yx$+17y71MDGNE6ZRqw^$O9%(UYUf-<1dxTN2Z$OQzGUsK4h#o(owja$W#gV-v4-lCahF86l{lP z@2s2TWDBUbIpWQ0_N}4dZEC7ZI};pXPF^mUI3l4RQS7`iy&&H3tcntUx#u9deK&AF z!Ea=O@guJp2U4Ja)Cf-V?p(QsjtCyQk~dX;_7_g_y^2=4x)dXWg@ql^_yqUT^)NoD z%x{ZZygiQ_vwv`qvnUhh;V~Z@ByNDJPbR~8`ZMB;xn(raWC{s!l@ktrI7+a1z5DKb~%_rInK)$!|6D7S$Xm z86N#|BQ&8{!!28kut;I73Bx=nNj7YP{c;w6D0|CWV#jMLWI**5daunN@=pa%NzV3< z@3sPG&_inG&ymSd7ar`)-$;-{@;W2yCmCyW#pY|+TPLiGV6!TPct6lq7spEYSDQUjR;9!CS;Sek+n<|>(p3qM zr|KmzgB9YqRG$(`8Gr%&QN!In1{fz&iX(U5Dfw(We%}9WYqHnVaEqfY@?BK0%apfL zXioln;g&49@<%y6Dt}S1kwhYtX+C6j7iPu+B8koay7If*U*BL1KQ8^jyQk;kd)b2f z9nY)!wV$WjE`)Y@3VA2ZEK9o(b`W#tgzXa}a(=&Qq{#Zc?oY!@Rf|c5 zax??qTptlrTccSz$fcjpdVf}uVQr74bCe~TT?cIpOuZ9o+{*c_&d?_scZcW;J|_2U z5uoKnnQph7x{qG|1;b*{M{awO3+8PbZr~nnu!SL!;{;-){;+CtPY?0CNAlMn5@VSf z`f$p&O&CF8L(h7PBCH(?+QD@i{?QZ2;0}?Wb7;OD+PY77i;y^ zV_Y}$iaaq#TZ=+M1r}rnsmsQObWPHw1OfcR^A-KplHFDDaGMo^j zAKv@ioi?<@Em))@azv>tb2$k^Cse5zEy#ZYMBP>36u&=XUTh`w&{7)$~a48If z{mWsx%HAfx&Z-$|pM@UEyVjybre7f*n>j){mqRr8JbV#XDlvS(cq`d!o8t~|)wce?%z=OxKUTq@9f7OdF^~T2ifC3iUxdh2x;{8jDLPtg5*RckO0l?7anQauV-xWJ{xM{ur3B!+8E({C5T!(pzD5s~wC z>n!~%^jrExk)px?A}B$>gTt<@N2mUCT@!|b4epSRS`kjlS8lNB10F-jEgTYKz5iT^ z{I5my|Nr;(CkqNPWJkE}E98#cvXYX+st4tEKx5EH}mu>Qx``i%t^4;Jv{)}sYD5(Rkv_rO>xGz99Uc0v%J zkN1BcN}}oi_f8J6MAz_#!Ub8E{6Rl_7gx3$=)XL5A_D$gE9J6lhlXTzdsRm`h8%M z_O~HH`^NulCg-lS#t#uf<0I+Jy&9U}Q;!_yyxJk`qrMwK?f_2&g8#Rt2bMu@65&^6 z(vdlHo!uJ~Fx_xNK77%V8!^tD)=fU~*m4&b;1?^}r;=u@cdh{zjk(CMu@7n(oti!_ zy3av>EMNZ3EGqFxc<>Zg?B1&4OBiE%=b7ziqvc;=Ab@+nQ)=CS65$4*awW-1uBt(T zM;FXqJvclZV1!d0`&La4KbFBYz_Fl*4t^0G`$bNkKJX7&M50zr{10|tX(cQ+tlR10 zJj64v*B^HBpDd?&nClKBk&E*wf4V9)mk13dS6k4+4@}7UR%|> zh}=r^5cn*XrPYx}C;TU-Fa2gX_@}vof@0A|3Sa+;X&x(T4p@F6x3~&ygwNf+aCzGq z7Z>K%3HNmPP8)fCQgxO7ag$jmb|p=Ke;X`jM4!m=D7_@;&dmXRfje^oOU!ucBEMyDBi`H=TJ?RIO@B6r^UhANe)~o?edm z|B2Zhd}d+@B_=2Jgu&1J;V>~3X?^>FNXH2GO=`zj^W{cal#ui8!d zh2Ry8Ve=@_2+&9mRMHapxj;o_#P9Vt9NSk7pqK%3t(gHd0R?36NiqYn!-FZ{(9j9> zmUtt}GPH15mc+mHNbZp13#99Ew!b%Lc`M^_K7eul3Y@S2wD(%+*$H*q)!FWT(2TIqnJ zM7v7^Ye6tAF_-dx<>Wb#Pr(Ki!jEfN#E}M@^U=o`K914#y0OTV5EudZEK55uZTz#Y1w2B4nE$A|9o+dg8Z4aKpB!$Hf84K8JbD#HjI1jNpCtt1c*&rwso1&qp@X(1B?Mx#ZB2k1 zpCt9S2LevMSPHxC$ocU7dRLE$(w+EqTg>}7qWP=)$j`SZOY=KKQebcseoBwaSL8dS zO@(26Mth(xQp)OR9W0tyk~_b}@nwM`>E5 zr?!jqrQ%Y$#WFkvph0el3!l4!mCgVUD!k0$%YaY#yfxEMN3S0fOYOLG8lfU)d3kVk5g=@S_#GZ zG6gUyrzJ2{c8F_rEajRwlpQ29)hxdZQ5XomF5JQ7CFFOOqjtTd1S`qa18fdp7`Z8e zI=BF_wYn0XJut^{4A0;dd#g!m9=FoeGz+W_hULuKZlzQUnBI)Ea$DqlYeBNMf*C2S zE)z3$bc64d7^92~-uOFw+NnYHq5$9>x|=5KOg|&lX+t*?DqOY6vjH_x7Q8Z^q&mT2 zVzlAj#1{SH5+kwm-^T<)wB8E3Uu&qV6Z4g1C;wDh+92-^cv!kG#7Q8==t{-8e4mhr zQ+(+5*Kf#k*VKDykcht?rAlzXJMm#rokr|gauZ)L^`;&E<>p-4HhFj1nGsys^d@D| zrN3W$MXCXN=^S54|L?W-H}2^?1mgJ$n;FO+ul{RG*FR0q)oalj{~!G~JQC;K|H0n{ zqAcxnB^133HKBrBK=!$EL+m-o&~gfW{MXQGwW5ipuq)YrOBT%DUX}6c&SpOo8naIU z9G#~P>ToA=Jf}Rg`MR(%|3B3h6d~68-}Mdru%mJ2IrSy(EeY?<MuYTV)epMQ59jZicIfDZ?ky_o!N{lhK$Vy3l4m0a2st1^`v z$l5i4kZwedNddPzArq|NN<8 z>|yPIEo9)snmb@Z;Niz=6X5*xVa1^%s&<@rB3)|e>yxD*fFig?!;g;dksU1{%`F>nh$qd*QUj^<& zRV>OYD)wLRjR5AeYM6pT$AxeW=R9#h z?e9Y5p<*yt`$jwC{J)A8eh!#)cQ~VKR4fI=9*K=;*eUV#f$laCr5^YU2Vwz+xrGyw zh$dvv2K*>*2I-)8#E7`5azr%Q#&4OkD6a9Y<+=@!Lkzs6ty|c(!!fzaEe$0Zx!+DL zFR3Bu4Xe>4l0%y76RN2U#RldP^Q<{JnRNZ_`g{+Ma4n~rP+Q4oN9YD6{_VlQl9Y&? z{i@&Om{*n)oudA%WrK~0`4@eTL8mS(I9WBaHbQ7GQFS$LIF-d@vcu1>&Ta+kUo45w z!`cDd1UQ3Y4*&j^^I$vuc!$IgTr;(O-WiHpmZZ*E`z7DS> z>q5E_=OFF+L_Y`W#w6a_es47LFkqK3Uyx%l87>C4)&}@hMu$Kg9Ri(*e09+H$nA** zzOE}<7@w)Lv0Sx}<0x%}=A`EYF*s|I2p^nedGPIf3!vS_-~U*Y@VUC=n(F-xyNFmB zT)Qvuda(o#ccd+c55}&r(LC=F5F_{mU%z9zyG7jtQn2B8vU|CaSr_+O zv}?_)C!HQ6Ya!OP!fqnDgqnCfu1#l4l)wB7L~uJ@+_I0tbcs_aA@An($@m= z`ht}~MaGCA!K0i{lk+1;+VGw8xbSiE?z+RM_bYl8+pbsy6EfFb3*wuUX-mL7fd2O3 z^f<17eJM!J}h245Y_|#G`D4OgX!^c#L}783h z|E>J5u7F8WQ2QYCTk$8T$6=CtrTXG4oB+jjF%WgrlU`a{dd`Ei;{!H7l@_;D4jEpI z?zi_+xlYhmr}AJXKF%m_&xLTFc(hZMKSj1TQmMqp$Hr@*7o^xzD0e_@34bCPE-vX5 z^)(=g0D({@~JyMy~p-38G*LGDZ%MEPmGnIkA|+@^52$dWB0wQ$Y(sV;OV`Q z+n*hGoxh?1eT+IuyRsHxd{(Hovb-4kRV&*A?pjnFhj7nOww(W0>4>~iviM&0VVi)@ z1}#}ZvKfwfHc|8()0$DM5+WiLBi;^Sgk8$7(`0LBeH)EY9|%wg0<^wGflJrXu*X zi=OFq{t;e|AP5#+4}us*T%rz?PeN0L`9a{#C#YM8L}N81&EB2L zdL{?i?K)NBMa<4LCK9cU%(dZ}@iKY1x7N~GhR=*ZNI{-^GbkAq=|b))zp&tKA_GH% zi+kyTplK_`qm+8{9rBh5_5msD`#^d)@sGl|$aJgl#abi2LGICff>Ay6PS+Uz$Z+%& z(vzW?%ZsazKoO7s>I|4UD5&gSQ*tWcy|viPL7&Jxr)@!)Rx|)ws@Tx!pHGEvy^d2xS zZNZ{w#n^n{v-*5W&0e|m*+j4v%EaNqKWG<{_dw(=VZ57fMuQ|z+w1l>Vb@Rd(*a*J z%F}sA^%zx_R(Dpyg)VeM#!xhfR}$Zw;xB%v(wn+0`u07BdO-ox-x!H}}*v+GVoRN}D(h(4hHp8&%JJo@+k^Ckqt<$HKj5ClOG1VK1f zDDWmL`1tNiaP6zpk(B5|g3pVO2Hk^yFWm_*zte^UciBZu;(Lm!K?#>&?WWuVo_VZz z%C(vb$Ke89fBp5?xN#%C|NeXT&716!lAfOK`i`?}3eSi)Z{8fAefAk1ee_XGnKH#) zb%p)O_k${$?)72C((f?u=Pj`4bi31fp-cO^B;frd!jrLU-2zOVzZ9VWP_I!3oPB0{ zDu)g;uoho@H4D3)WSrBlA3CJ^@zrNvU_+salY94pv0^HUGP~o9=4qJo)qmhSxj)+0 zqEV3%!u&6@kaFr-=+L-6>^(nY(&TIy4O*e$*6}!VR1!jSh9YAa^p_qq&;Dz~2OzSViXaGrAPBE1QF$#-{5OEZEyk6M61h;OuGu1kM?q2?140wDtzWeXXaDpYj>3uV0 zVI9q@sjy3T+0|6aCB_*Rm&H{Ba5-{e~;t*o>!uK&$<{kY9Ste?>pSn ztqw{-!4H`5+r%s(*v0mj+ zbfnrjxZ>KoF>}E$a8i;m@ZpgdIPDpHKUc}X{zPc6mi zv+u&=JI=vnd0)f6>P}4m+uv~7ORu3vY8d11zXnZ*t-`s>AHn5!et`R?{(>87&%_l^ z%)*!BobZQs-zHSoCpfkrugKm8OYDiL&5qD7`Q+2)mOXjDSYlAAMvUN3vv?T?hA`{?LuK`z;%HU1VIo4K@g4y zYy^vo5D0})5=g{|@h@Y|hFK^|s*eY+KNA}_ZbgAV4_|({7`tb@hCv_H#EPG$VfL+; zU}{bxf;rRiQPx^${IF*w@tfRKgri5?R0Kf~1VIqWN5#0Q@LC}X3bt*AlhzPv9@4u; z0tz<$0%SBnofHG>fB6}k^8%>Tsx9i2?na)Gfrhn{v17v;I7xL8*tr@-o=mi;p91H1 zx=vK6&$w{(h!__HK@bE%C?6Fi#u=5DCbX@+Zpf;x0~WiVDA05bDrsO|*n?jS$qR#6 z6wyuNkUmx^t{rj1elHd3GcE{%AP9mW2-N|bgmzgiZAVy$^PWSRJmR`lM@aBHB-rDk z+f76JRwP^@Li|XG7#9RV5ClOGgkyw=aX}CSK@bF?%E4|Os;VA$+kuGBcqJn~1VIpl^1=FvA9g(6 z^eNXXIXT&VqkWvcVqBA>w8z;7%iEZ1Om=kki+sT&~_x|ob-&$v{v$}il?&|99 z+VxaDJ6us-0v-kj1_%fUUP@9_83+jE4-gP=Hx$HI&6*~%<<}puld^;`Q1ukv@mB%N zTu4p`2&gU=_RSFds|;-~sp$j+gyQ_y1-xlS=ne$*StKPYr0TABmJRBUCxsibbzR9Z z_QOWcX06%w>z9eS)_iW$IJMfbcl=p#v0_pHOW*eAqk@8?Wzp2-QG0Q5v0fUq7<&K4 zJhacEp91-aA~8xJ;fb<`&GX5OgV(U*0^}fmv0UE-dxEjmiX|`ki z?;~4f?N7DP^Kw`p1A7X@uMuE9-xU0Y%*Ux4_Ej5epQX1ooj+<>CpwS_$piS}i71KN zpb3lUk?mf6;q-S0?)dRr21|_1G*h1{YIFBk+TM$W2fdn$razV|yOT%*K88}cHYYxq zyPH`rQw0q5Ho2F>S`w8#QiVI8MLr1=85c$d58rilE>~}9cF7qk{kmylMLRbR=iku? ziz)Wcb*IR>spK)P2B5m*gH59ZzV}e0viqI!CQDJ&4X%aRm_3BX43(y%g3BK5&r8NA zuje!IQ^z9)F;g&owD@UqaslchJR%Ws3F$WpMOfzpl3El{FEO@K$v&0ahI;Y|spO#5 z#K*GJ1tia_q8C2c69xT>K1XH!Y$0ZA+p^%_EaPex*x6&?G0e)fqGCMvP-* zqeZpN$7k)UN5$jU*|W1m<`xb0Gw*r1PSARyp6{!Qrw}+{-u8VkDNGO+F}xUikh(GP zn-PnBBME6}W0EnO+>L)*o-=nCdaVO^m}7iO`jQnuIhpQzX_H@nCh)QJJaT;aBSo`A zVyOP85MiRH9$AA6*VFK@0fwfcy;ZpH`xqLbg78W;7w?p^0nOxtCG`gsbxZqgtuXD1 zNPZNx7DY+hA`wDT7OGB9h#OkxJ{9hrV_%z9i31u^2?g0L2lx$5PPy|*LkD*3Iq?ue z2c8ep>Md~pK+Kz)4Riff@mKwn!jJ(g>4(R^#lLO~HIy-KB|7})p&ff)WE;Lt9i8tV z$vPdl0M6_oS5Yj2HMswDfN<#bRE&Lt%%X2R5^r$a+k#q2yhkKj4SDDGjpx6;-on>n z-_#5;^oEt_S;^{|q5g3NC;okzG}y|XYcle$fIDx3+^%O&WBTJMbPgBmT$wd~A(NRL zYqEq5Mnf=}$GFJdh9RAgXrOv@69DioM8h%mddUR%+nCCriK>V{ed15=8ybFd^R8g) zD-B?e{Wg${2D^hUVXYmgrwlL4XCE*MWXh>c>3(R2Sc^@h+=?R27OQBnJ+)&KFY^0} zwVU=wHX~d8#Ru3-*Sjs3Mte?<_)EFh4fyYJvaz#`mavVs8z4@u>-Cx+?z|jq5-Z`D zwh}0ZZWCgmuIDrPnk=0WTkf~0CbEUdpYpg|V(W>w*3Wf5=eOQ=JdXb?!E4&2S*2dr zO93J3$k!|zo?pxjg8Xg#-VAv>M|OuIk#TXYd0xa#^yx-P4G0^6ii!co>%~iqFLxvz zFpQMtAQ2}Cn7HANZ3ViohRvh~YFjy2^>5A2NX}rl2z&uS*$~u2zsb&lINa1TpCJvs zqf|DzYC~`w$D3`_(xpS_wcl-H2wC=e zUVKUHCWEwZ%9fjLVVCUI1N$%R7EjdciVb1T5SsA4fs?aYbnwXx@uxE!8fM%!xNTP2 z3DWn&f3~dnNuqGLUDqg=y`-q)_}c5g@@}og{IgR&_#K}QFZ;Brmdsub-5>6bz4Eid z9TLZaKi*&0Y`Wo_M}Dc7MNRVPleplh!&R_=C*KGRHl-#b9r?hDolrD9OZs=RN~b>( zOY*h`)pqJ`_xQEDJ3GBgH{vnDQ6GxhJ2(a(FG^*3y@7#dun+g5Q-}({Rg3_$S}ovZ z((8ssX0MvTRucY(``S?>2Qmq@I-Lg9PpOlh(;AH`tbp~+0KQl_!G-Uv)^li+Bh@J9 zTO=xiRo)zk9qf|5%?B$s5@vS=oviq^s=VAyzF?cYJ<-jHOW`Bah;+r?Y{RpdX4md} zA8{&;5K5@Xfu!C^NKha_q--1;N-<2)?ha2Fr*gjW=q1C{iOQu=H6jc(#toII$P<$ zG>Zg(f4OgH^M*WgDk@OFMC%s4UhN3podgY*QZa{3JUBz;hVLRlvwKo)#WuaY0_O2L zKt2#a2m6$h3pO+d%ah7k2#h&{{3AoZUf2V?whFU&D1bp*@(Qh}jyXVU^M_ovM-C!) z5#;6p{T$>W3MsCv%;G|2RZhc$L7w$-64uZW4&m7Jz{-{)?-r6m?@^nKjbuq5!W23PF4Rtw{H^54d$^kjg~5T zU#<$_`^i$3_3i!iOtmgg=CSd|uXFPTr$hNX3nnSM4}9_IRkG1^%1;`MN<@i8Z%n4H z0j;yPMV!!TOu?}`ZKnJog38tF9|z3D@N29i832h|?=p(^WKd5vnONHZh%?y9sK7rz z)GQ23)cOq?^T*z>jnay3Gj>+*4>_4VkkxFmDOSH#aA0w{*qr|$a}}VAl=mnEklrHL zjRXgHF?v4}**x8%tNnl)8a^I#AOhjEa}c7xnJ=s5fMGlGZ;kR8Wb_lGWR(QB!|Ny* ze(M9B@w;bR-{=x@HjX92lA)Lov)YHfyA%M*tI^vnL{>bMjom4%45*|m_Z0PWX+=}T zj8>kzwde9_Wx3%;iv@-fci+m(b>&4dzcJ%!66;>9YV?fsqhORwI-Q|r zp{|oGIqY5Y(Cv-Q^|Q~rlJ*2a7oqFJC4;&lXZz7?$9GItTUG?afRfs-?+O!7s;dd` zXZR~{9zXSDw^VBM_-r=X(NCAEUXNPbF7+~NKIvsr zXaj0;39I$m0tM>LTULAt9TTh_cVHvcLZ;n=Pk}d>yyawQFV|tS%d`92W!@Q`v~4+g zC^Smq<46V!{OsU7#16XZCWGYO9Fpy>jMT>GFzaDC@vKiOq;;b2{u5K~j{G zyIC{v?(ps>QJMKXN5a3+sVBoj}i?2l5e@6O|KDQc!)uyCT2kmAfaa}l`f)}gDh)wIj zMy47yZY8CGk^H1y^Lrqki<$QNS?*Oyn`}HGpx=*H!ho>Ef-3Fyc_`WadXQUfUPi$hONYBwb-nKOkK)}8}{EQ)ng*0*NN`UKGhy{_ex6XvlYZ5Ur-3PNgAfK z1Fo9y6a}#2#~1k0^FpcZuIJ80bqu;#m_*Ms+3{h4@?Oj80-Li-l6>5pty;J-)BXD9 z7pBAJ_EVu?a5TAsmVm!gw3>J{tBA5(y(*A`pE_&31qfR=$sNNIBC!U0^etoJ_wQzr z$>TnY#af~v4rDocSS$^qsD6wOn`L(^3)8fpn2MvWaO)uxrZ`}+;&G-~0eTxUJ3}Au zrL7;_5a@0qr#kdulru2cS#+GvqmT^xg!O<(3N#O9bnzUk#T|n%kuV?MGp!j&wt7?H zgmN}y?^BSIY0jAHZyQ5zUfzl+{#EaB#;ZSq^QQ<$180CY@k4L|W1-a{V1=tXc9plU*M%lyGg@hl)17PLXS6 zb}c@GGEcWP)<3@cCz5m#3ZLg45(SJvaFvNhhildO(P4wtBDJWvnBlfRFngw($*(MI z2K`QfvM08v?1tmpK;E2!LlI;&tNyV_Vkl^q0J&hZX_L@;0BYabBDzoHr(QwIr$i;k zLH=EefW76#E6?hJ+&v`w6CWV*{OL2D_afav;AxGA>tBd+IkC)@+0!{L-NY<4Q|#+# zla>t|`ukv{?*5s{Zi28>pAY-zLG1M>G;N5*Q_r*eXJ2hE2UJV?ryX>6fECwG{^I61 zJM2I6$@(M&+rjN#c&3Ud`4jk-EBM_CPS4KP^vnGQcOsixoA_*L#T=d;d1Nd!QO*Sa zSAtJOn6}+Z=o=EM!qol0J^8<}Q;RWrrJq8a(|>BRdLS|X{0A6KF$DSW=KcqK?YuGn zVaERbf2}pb?Djk2hO*-)VKJ}n4K7o$0k-CQCnqox5)zs4{{?Li#9Ji3{DjO8u|Ca- zpS~xt|LO1<$+8Q^a!3JM^5d0B;6Fg?P=&E<6!ZTi>Vc{NT#8Kn7ho})ICh^C|EKrc z)3~v=|3P~A-eWNT*M{^Yll^~_39cdjKS)TW^FKo%(U1NIPG;#t{f`1_0{zMo|0^%x zN>}Z_iqeP5{h#iLy+gA8dtZ~i(ErIx{gijkaqTps$F%ZK*r# zzZsAt)t*^?{(8$aK^Q7!Uu5*XwH-T#yuIpGzO$M|san13{e#VeY|tRk;|*2rk`(~8 zcI{U1*cYa@$mnp2pE(pOcIk!ev)U*IS$_C%zLx*}7I@itbNt}Nh1NP1*>bI_@jtS7 z3ovt~?)AXG{64Jp81U4&cMteoqqno#Hc6Sv#pGG@fn!+ZpABkIqZGdabZH*DjgLpi z_09-(SM?`k-34MNqlB0 z%mlXH-ye-@e?A1;>3t2upqDFlT7Mj0vca4g%TO@OEtvOxE#}|l`G5e)BtCq@7)^$G z@w2k&a3?rq(CHmo3(#2W!oqMV4|s(bo7N{b{%olKMnhG%lYyxANHcEZi&dlM)*GmT zan`yYj+;8Y`&I;db>$PG^j;xk4qhI;36XmXyKQ#+*)@t+Z*c2ESb3!K>r1qF8V$Lk zp`2S~KK(9FT=SI1fuMW7+MPP3o4ao&%nyYBp24l*U*OM|A=pfTlaj2LYnWPKyEdI9 z9AE~jmzx%g<=={@R*6==iITG&mS1NxJ{Fc(U_iG=Kl^n2G#yXDs&xkKm-U>$)qsSZ z>Z$XHgKBHWU<;u&Uo-R_jCP9kC(~4H_V1Vsk<5TcJ&Y2xl3x1kr(VEs8b0W)HChQ~ zve@jTGpp_hIhWx!KG=lJA0N6WWwIEDC%OO@Z?Xlr>Y8m6WSU_z89Za5e46`=$~r_H zhkb7mMt1!qYUi+w`VquVauo#E&DjQNtJNaoc^;CJMK`@^JF(D5t5Y7BobRwVv_=TEtcr6X<+a=o6^X6zA+SfNz* zs@e8?Bw8Nt5P9BA)W4OL^~vj)9tC@|1&f^oZKlU}sT-VgR&TNtcd{N?=t@<4v~BAC z>TWdD*c@kC83IIeYY9sR;|Sb=Q8WBP)1ALKzA-=~qlT3DxD^r`%Ml}s8#afJNp$kz z5p^tZ$#>1?BxtAOMSx1U=9N^QLkQIspky3NLNaBR?*B8Br_S$#;8^fV%!32GeR>7K zt_O3ur;s$`K?g92nG-qn7+X1bmIoi-BI%RmwI5UwIzpm9jMIF7NPec#h=E&Ew|IhCV;<)3j76$BNZeG&;4&!Cl-3x#{yt@{>GeDPBRTB)M?PV2Og}qdz5X@MJw#XEXnIg(&%g^@SN}+6@lrXe z;sdPS&36_r`uulT4+J2J<*+C{OgY~IeBohs4w?Z5iFFZ(TFQAOLLPRQ%Ovq)zjMQsp@#A|)WuFuC6KvGzc@gr6;e-wE47)tI@LZCS)Hn1rttXMG%>D8h!51RjC;`t!j!ABk| zZrW0xGpqll(afx4J3=-0M;OJ6MHXZG(`<(J^Dhay09a)e(3?`*^yF98P7=HrO%f+%Wf_9>Zgy9mfZH zPoAx#!?x%OQnDqHTT-{Ks2KkH(uE?|ZYBD(H85i3qCcTUnjlY;jel~Q669nlfoguw zgP?!7Nt0=C>;Jo9SJzwG7Z2m(%%9_J6Bz zjN|zjs$UyaFx!r&mNo;np;M$L&XW zFUpgB@GUV6yS)c6;)|dEh{$@I7a<}c|KRy)i@}s4*1im!UO@GxKA^S#sxB%Z%NRYTof{pZdg}?ukW$5>s_~4RwFw0 zB)21hzlGabVAJ*Xc2&mc2~@JkLQY+cAN2H@TKN2)z?^7&g~o(`?TZw1f$n!kD^hp4(pM@ zWH21*XG#izPM3D+o#d&xI@yQi?RLQ8@@~%ioJ%x9`_~17qaXESp(TV7h!@8CJ`E4M z${rMY4*1mzX+7)I0eOOmBLzw$lw~L%wpa+s%qqNC*z1pgzg?7g<`XL?wohLn+Q4k> zp(T74cuBDXk2`81a99D*&=z9?plQYAEdjUClrKlN^z7Ki#iPL;=!AZSXB9aF0P z3mcO>wvR3|-^cM7?4xr`^tr^mw+E6X8nGU;O0@VCtL`G)f+9_r(QF62S?{ob0)p_S zxqWV-H+{0}%EFMxd4=daKY?9c=;hPlthvkU`RK}|vJHH>3{{kxQ78wDFQa5&Fk|20 z&EpM7w0CTXZ?=5^;>q1caOdURJ~^YGO$^6`Aqg`aJ*k;($0G7?H*v}j|4SRFv=GI5 z0|svs5t00vHTgBuDX)}&$ci-cPPLYCDb07`xcAw)qwYFwgL`Y!kcB{a zhI>V;#U}hj1M4OC6AVD38DVf_7ERTE!m7p8gs`1Eg&mJ3VvIO7Bf}gYAm(BX8Z*^7 zm*o_R#Ou&u82zrD(^z5W7(Ra#&#woyjN1upE-QND&_WHINT*T_ZhS9{VK$9P;MZC3 zxkZnnqnBvHqY~{olRN&^wInE+335?wNvyLPvg@kM%dAQLglQdJJu|jW+;ewy2q>va6ApS4@CL;4L#H!>GKe62 zV~*5MPdS_fgg{>aUgcN*Xy$7CM2Uf{64>)x?GSA+7YJg_rilM0Sm<54606fo3u&FX zHP3eJreRp*3M^0N#v!8w#P%#7Vz3773?-VRdM(%-r({Ey!$+*cs!WL1kgawy5uV%B zhFGvHz|mCNP}UIp2Wxj&frvE8_A$D<#(bV^OcHyK*?OBjnmkuIsS^q~fgTUIOoq{D z=A007NwH&5{bB?^T&mrsM6>XI++g$e`{en!I|@dq>N9okxe-U<*&|j?4Fky#h1pnD z-3O=B67EoG&X!#?rw*SZ#8P3KQoe!KP3b_DQz}xCy+qkpVFb|z=o0hybw3XTOdHA=%YjgHWAh07lH_`)4{m%s$k}-!k>7QvzD~*XKZdGj zV7blDQRqYAiY@T%_jc$__O0~ZGd%WsM2uh}F^^v@mN^tBYY|TZdKk#d+ z2P}cnJLD~Q+bx?I(Zd7P%_m#2tdceHeUEYHnH2E}3_QXsgG@RX6r8!U2Yxq}WMKr2=e$t-GQ1e(9SyE+CXp zm887OeTF%&3HBl8cniA0$tS%&R$s4zLWCZvvHB>DL&D;}1z)ujW+Y-I`{jCduW_fU zKI_+Fr-6iwLwC_V_$7Cio4wEn&$Xujcav>E%A~gO$EFwixL-^!jW(m_f`zkX7l?pf zf=^Db%=m2OmfG6v^w8&-6%i1`0pJrGvZZ*HCvt+r6a~_X?Q$uW1ctp zz{~9Zhr}8i2?2;2&18X}B>ilw1=gSDM4 z;wLC8bpkmiUt9*nNzqhj30sM+NJ!6xoG|+}=e%SA z=DG2Lu!9l!vA8-g?s``>iVjn%O8r7b(}HYO?=t8 zj%*Gy)QXM%^`{vt*G!%lc&SaOA0(y(5A{fB$>sO6uI;d78VrMh=AF?}1AUyQW)+=k zMd7OFS)R7FzCQV&*!tJ#*2AhW@^5c5tp}o+lUovHg*R5`wi4_nAj$_7{#vFitF*g$ zw;}}r4PSvOrJ6Y5;#dqiahp!mMbAdxgI%PGK^_OQEAtz1N1+Q`N z29fmrc9lZ&;`cMPdZ2Jx&Ja5cQ+qRY_!hrwp~WXSrT9shy4{QyO6O2AfB5pMwEH+3 zFMR81qGlgNwiB#SiqP*=Eo~$N4`gbz1y`+JL!j_3uy@jPo8ZHj%nO_?*Y;z2|Jh*8 zXmzX0RPElMLm)I__Fb`9&#$u?D5M0E$>szE&UzVNLa$SR;lbunW5ISEYLfiNw>;wT z{8McTC2Z@wkt>0rJzLTcqd%>NrP>wr5Da{wrKzDaKh7{_qaCdG+-do94Nex{fCfBc z`xf{`>W;Tvqi`D0nDXE8qp%tw;;kf5vXaymbe*lYkQRSA56N9S2$GRMT1R`{pXTlR zqr3aL01z=MTf-7%yna6JCWc*c#>7lk{Iq!w_-Q4wUf_ep@cCGufh`j97-EZ&}XXj_gE>55) z?4^+@RVDLr(P8fXQ??oTLhsyI?RW1b;EpJz!~QZ@Gu6;19O*!6I1QKIovk%d;c?kT zN4jB&>0RBMaTl#P1hYNqYIn*PTIg-?WNg(TyTt7p;K}LIHVRO1Tr9#x6i6f$BU0>` zAOwVZ*wK~Ben4hDECDY;Vr|xQtUew|`qV?qyZ7{PlD*CPvQ{s_j!f5xormDpzGooD zFr3C}xtta_&euUTJtsm9PUraTP%Cm9~CcJTptVzopB!r6pTZJU8~zNh3lLd+93>w<-IGFNb^YyqT<&bg2VpJzqzZ}EgX!BK=qQd7ea~=Va$NMF$_K*&xh!zAE}!ejtrf`SghLSY zgr?xPE-5Atr=@cm-w%)<5#I|2<~D=ugZNw`d;r87N1os7;1PHcjsGGZ+!6`_Er$l= z_lto0`T2dkN(t!e>l2fci$BpGqzV^h0fIBh*Xp8SowQ+xtfo*V`%-_yo{PUxWw=FI z(8{hq3bT&Pvne?2$cDwvG?;+ybWi>;er)dNMl|yzR;5{yzCyL#GHli$6WLbF6J2rW zuki8;&I<~K+Tf-~Eq0@#pXd<3$ngs9TpWh(Gk=AB=CMVkeK{4TlHk}eXe2r#RQaCf zNUj_qGDz7-6{pKdNDejY zyj&#!KrnUQ_R@Akz(npw|B56p(O#0KJ)d z2>VT|+JqnQ^VKalxX1`EcR>iN?U*UOQn=!61t9Z>*vOnC&mb05cp*qkI0DTUAUJla z{T3sK6w#vfEhC6P89S;ZSPlLFN<|A3qc}Gv|7`>F*M2D#Smp(k9~l+tI!D|H<~Sg* zXc$JR4ly`HZaCbKuNfXgYpRnPOgD{OwVX$+agDFEo6!V!Tmi%=7B)HJ9y7XN+!ee18? z5ee2x4uP$kAldbgWAK9g1&sbat4r*^(zV~DNGIZJn96~jYm3Z`enEx>j|pG~_k`I^ zmoyy5Af)H*YLy(-vf^w&ZoaQ3YSi(O;N)=1Vs!iiW!RtACtN3tFWRy^5?hLBmA6=eN@tff{>j)y`+DSnjQlVl$vOS9U7flx2bx`9TWbV{7v^7qj;xI3E!$tC{8 zSL7rq{i8*9#<%#x)ueBcwD8Wt5~X7D zO(P-?=3L4_Yqk{Cq5B78l9j52NGEvikQ~%_7OWSsR3a@Dt8Y1R|}8!F3BkI zkughzD;Vv@*A-z%gD1z+c@yct?>r)%if`XB?rbn1Or%2CbS^L{y0D_ zQ2ksir{Vxxj1D;&HB$Z=R@G^0r5?JUOi0V@N)VSSE2hYG%|hlN6M{}Kr)2itX+lSoAwK7Z4T;g*X4d|w!FW-_6N z+!jPQz#trO_HA5QA6@1RArkz!;Q*2*gjScFtbTBAaWE`72)Dqo>jkU!4;Y*{D$J5) zOohk|iOT*aW1DG6U^U{k52;v)v*5yO#SEO^-75NA|b(p3S<6Dc58C%6v|eVnqtlRUb<9Ib*`#SUdYavSe22=^=?E{^#U ztQ>MXE*Y^}q|4-Y(XkII+X1BpOdjN{Uhm`}cs*QD=QBc&C*TG?a8fAp8>T7VB5J4;*w zh-RUvVUtX7A&$UPWM-Aw-mF(cnS#&@md(;O*= zNbt^HnxX`gyAEbD(Y(gprbDM$n?r&qor6aS^iT@_V8|jrIG)FRNf8zm! z@F)|o`dy23XBQ}aA_6O@QI+hfj3TSSw7=T$d|T6-J?3IF-0~c@52;e5Z&T%JlmSXN zF-QDlNfj%{}dY+|q6J^-jLN920lBpAP~ z!4s+KsHQiViDeCGoD9>Tuze|l{UXg{2O>v*GaNMg#(2Ye_J-~ZgrYixPz#!pz8DCiOT-RB|v<*hOzgr@}eB<&(s zk^q|`;CO>nxOC=&!4%uI+Q(i8n_Ld0sT(XDyq?orw!t*I+Ai=`Lm6nNmQHx90Ksid|UgA??fLq=Aplm+lh4!B%kAr z8WcInE4M_F2{)`V7+Zb(I9>3BT?m6>*m&|zUOJXLZh>$PTub_vM_kS3u`+RV7B`&y{*^7am)zWwg+n=5@v9m%5nRKhfO9a1HV@ z{d8^-Pd$6oN@Pu%+b zl}@ih2HRG!f{=9i?=CZ-<#5@AN?dJc%%_lp`PTe@nQ9wtmPgx{FTkt_xK}I|#sP7|UeJo@iwq$SC&p8%BShp5yr>lXrkzEftW6rk4g$Ochs9lp@{(fV zj~ry)A9*59PBz-G7*={^-)d?VW+pZL)9Mw$VyTi(EypM3WMG)s-cY^qd>)r3W-~}> zZu9bIEz>MF6M?QXZ9ZxLc0vOePDi%*B7!pSDZSUuNpYXWOf9aO?P{cORR?JunwF?g z;A4NW($Q=MHcl1dP%u5XV!ajBx*i8ym*?YPf6yb5`iPOxR@w7q?X2Lhn;`(TOvIPgoM=C#)FxZojNN-)spF_uH%CBDjt3*1H6`J1OzU{yHc2VVTFj#dy|xV1Q2?`+GLz5_Bb<9;4u?6)&D87}=(wN9YBZp9 zg)a8?X1L6>8S^yawQ5A!IYhErbe+Uo9DKzVKh>A-LZYgO3Fq@6j3g`VeGzQPC;txA z>#ybsLh9S02%Ssne0o!@|7^Kj|FAu@v zKsL1|4Xw>XQoj~T#xEc{?0i5)FbXD;eN*O?VR5|HfJeUaKm`sRyr@;L#RNhpbC;{t zKuc0*BYERPCgvpap(Y;z?kf$FpHcMvQ}`~q{)7cO9-bSW z_V`Yqy0Bj?66{$eaZau^*C`}tRl+`dg-je~6a$kP?Rz{ zsJojyj5t!w)y7>LTj7ZpjkG^n%VnC{ir7A-Q8?73i%gl#vBjL(X980)KT~V4%pD_C zXpDvB5Q=G^$Cn zDI0a|#esqkJhgc%_iSBIfkvoMM(k>fJ?j=na3+J5RZ0B`}qh7OF7%ww04<-Jbs#W6?^X zRv@-jXQ4(GGzqxfyAqDYQDMBhax83Ed4tKpPX{d8{W1~{?Pte@{))Ua-J7}6;%W|= z{gtxJ`lL2KbP)Q8?fpt)kb*U*JiN2b{gVax@cJT6CjZ5*^M%%l`iDzMygYvKzZ5$t zE-$+=voCA#&m)|lj5hPE|I2?10TK((fFDkt%mx>?4AP!b@b{?{t5_7S`rx>L?%%Qh zupC5GTH(L>J6o|88p|K?0LtmKPrPNipX+~F|8++<_`^5ZZ23nO`nSIZdG_@UNx|i@ z!`1(*k+X;NZ_%dwApaiqkOL5Y^ZA%7eG24Nb&~i);I*X5&0mZ7vk>?5n(*^lzhD22 z?YV^LO;D&>m3rsw4339~=O0$1FFQ;!#KXe_w6E4^&r1$5>VQR(z>go|WpZhl$0bh_ zahQ?^C3@--b`l-JSDfp)5$Z!!`W0hz$o`M@MJ-=;#T641jZup|_taw;4g9 z=AmfiT)mDh`O@l?xuWG_n1=%*-wB%7^NEX6gExQDc?W?S07rVLW4z<7N)rO0OeO!b zHn*z_-xEzT9Ddqp6GkCjhrW%5O!HS>NyKZWK)sS*$_(70nA#)g>Oqz;Ac$Q0Hm5k2LR7)BTO-;Z+mW>Mutzw5RKw7-ZZq4zsiqhQZ?cqhw zg58XiN7A17Z-SIa@y}D!LP(rcy3nL-j_rwfA5P~tD668Fz#2cseo`YbVA@n@C|DTM z`07A4TfmkRqWjD=1rZE}2qmx2R`2QJ7a#EeR>&F=z=SfL%QxWEgJjXDh0-c0YC@JD z^nNw5_l+cq%q)7x{bd0(Z&nQ@`|=0rnO0S-J7^29Zk^vF0Uoyx%nCvDKv!gxB|qE53uW*K7SbP)eV-jfp(^rgTFm*IThA|= zW*4voCS@h_pQ_)GJ|};KP5dc3y?w4Cd^h=pM%PLSJr_si%f|D*V-0rl`JF?i4^BNooJ?Qe zE`-0_pGLC$v0kba`dTR_<6$_~AM03|?6&;}lbN=}{J^?Js*b?1HF$k(=6N%vh1l2t z<)EJ>=Jt21ETc9oa5k>NlkE+;H|Gn`0QGsM4W^_!^@2Ru>LYdH7nO>YsBxaJkLt40G23c!i5Z$oCcMwpHF<%QIF`kOhsP_deez1z> zkBkXlo4&x-gtV2I9C&f5aM*XCJi}LQZ84|EAoPH~9Kl2mggVn|2IE28>YEITti2j_ zYF8RIavX=js&%J1kUs|$^Rdr#jRbZ-JLMZ4<}J4w(`l*MMKutE;d>$Qv}1m;lBW)zr@qnHgiFiHMo|u~z`0+nw>g}zektJ%>+3tZfjDB3?c-yr z7gI0022E#nmTOB%)rQQF3_jr`f@`Yp(xqZNuE>e;%gsT`hp|rP@_Q32PEa!y1_~UQ z;FYa@`;@}Y((Zaa{>GSgBIc=3I5KEcxdIX6Equfj*OT-|Ry;f!`CHq&;i#M*A24sm zrFbW9u_j;ivcoN~j(iAr2vY0KbrTc=L$6eAI>wA+#fOV;WTSuLXjJVRdHa?D9kZTG zj~VvEY(m3WI_CPU;$?y$4%f2dk_P6^=Qn#=WX-tW~J|3Ku8SnNHELn%0< z9T*(TjN_X9p7etWN5!mKRBF%k%nuK0QX5$QnZ&8|H`^J%1KbG5brQd`;( zuT%@jT4a)Avm{^x^lZn=o4L4$HrRN)#PIq=chocJW3x8S!2AP^F$7G|JQv?`9XN69 z7rS-p$1ty8Ze0hH(Xo6xA>BxpmXZaRCoC&9R|1A*SQ)Ch!R?J6XNwtO;1-_X<6@ph zk0IA^G+}JQ@wq`gOs$qI*_F$vZWlhYrHb)jVHws;6Sb<+EK<^gd$Sj<8bEz0z9_NI zYLYpa@FE-^*b#@3^QS{iI@)i%J4)03T*wRK&#ax=q?2GNRC1&Da9k{{Z=}vf1%JJG z4xi10rp&N@thWY8CsXfS?F<|(*O6k-YWV-yXg6G{)U;S_q+&Mx73^}l6wctmY{+l7 z$*UCS=eYvYp-*WL6Dew7&nPS`jD&&~JjxmQq@f~Yr1SVjM2$%o4I!72r@03~`MnV* z#yx$faL&;AHic5NjXi_IHUz_^;-|=K-O*eDI1Yz(IQMsI#KccA=YK*|sylQ~I4l4JXfbgYjb@@i^Az_cjhE5bAg4&4^4?+)&y|-0 z3jS)7&}lQB1KVKKs692V*O}C=cAj#d6&%?PErwJuJZojQ!cM_NL}$9F-Kc6i*yegC z#evl6F8K>f=1Src6mN$+_)TSUoX&s^o#IN_5aaH)znIm+fDIF=Je=6|tburu+RoTL z&!}E?rwNst$WYXn!@+|JWfOwE+fu}mbQ92)zhomWKjMeqgIL!=m147&6K`~}t8{Jm zUt}8oKzh+F=VXJ1jZ}JFlp#)S(y5dJ)lx+v@ATWLY@Ynw)>cl3^QZmsRELuVs<-PA zLM%Q{)|ZEKSPBY?+38RVJl$(&ORqx7OlU60|Hsrj##R1>ecO|5+qP|+lkEwU?RKu6 zt%;LsXWO=GGA2%T-TklY{yfk9a=%+!>s-Hc9mn@P5FKtDo3lJrXyvut%?A#>3BNmw zXjpf~Mv6i7VCvObjx&9p8K1+1O~$C)dnBC6YB^@K zx&~p+e=oBe++k8Ij$kDeez;UL(u#%3=?CQhsydH-!ZkTPRuE72x{!|iRxD)oMB?NF z05l9NgiqOK@oZIk6L!e~OpG{i3Qy9LId6M|FWL+HabOz9YE(|Jp(HT2kuG=lkVu}o zonDXpI;$p?E}1fT$d*iq3C`sKN(~_lZR#!tXXILE%Bt0xHtzRS`~FR^9Ii1vh4M=> z1QKcp`5q~Tw&SQtBs`=qUkaJ3A3lu0LFFcr-LgaPY3iBNmH=+ixPZ7d=u242AJroa zvou-_SeDrw8;WB-*Gt9A3zp{14nb2khfl-Foncrlkwe0>j2mJYo~e1gTUlCz+hqg0 z9{5%!Y|w7QHDK}EH|Zkb3%l2%R7u9{uJxxNJiRQ?O?@)7P9vdav%sjDs{|0yYrz?hLrVG?60WEpTm;mFu z7i5hXj`TMQGX&X37ypiA8D*CRxtB*%3`Zf~Z7teK9da=3`^xX3sf!?_Jztg{e1`=hOg2!+n_K(>zbprcM zU(8o66sfUx3bGj;3~zB1v&+Qf432t+OG&)lvS`We7b!OP0p}bcAB3pr6qy=KdCh8V zG#T#dzF>%zS(7)#r>b+HrEk3XORuRDi@-OkWL;EjVmXL!a$dvIGQBp5gKf#(U}sn@-Ko&06#CFnI_@4?VgpE(s5 z7-cn;Wx7=HJrW4Svc~u$K^@Vs9u3ySzUwl^)GAU=E?#&Ca`hP5EeOnC0Pw@EZNj(R zVo5Ees<0MTQJ6u(Nao>&<@l@You+D>CtTWYWN{6Vrj{K4z`!G2S!xqqE! zTGq4Td?QOk^NPxfau?eY&!wy)8U{)pdQ775OeB7N(*n zh7*1($I_vqTLI@a3i%u|W`k^FYJSXC{rt{LU+DBQNOi!h1}1lY*y?e_ zs*Y0;qB$+UDc}l^>@80Uh{4CM{MM!pjKsll5}<{mPZ|H}-Ga0S%^qt8WOFLXqp9Ni zYu>F*K4o+*8lEI_J9s(s(ytXqqg|dC#PO~PD?M^CJU!5I8VY~B?3r zt^qsWat6%aT6tgDSso%4cc65_6>+p40}-l=^S5y-CFBlfJ0}ZuU$(!I=_^j>WU9X@ z4TY3Q5HSN-|7$wrIPO+LwIQYIy?PweHmIqjb2cC8K{Tl&$E+!)>)|OvQ&`Y*twm`} zAI!*pR2}>dm97p!WK^O!xDJ41K!k><3PH35X1#H6C@4V0$gwwURYNwYVeVhEs?{Xv zo3O6eRJ!G^sCyyY($EfW)k4PTZhp+#ve!c$sKQ#|PN^F;;&1TKLDGqk!0R^uG%(+2 z3T3jKYrvtVV+OWX7a(diz(FTx-V}t$OIw<(cxHxdVzJiqllmfUG|bvUKZm3WwNZ6E z34-1lh~WPL~j>^_uF}WCyQmZW3|hBhL2=-6NMX?Xl6% zuZ`W@5DS6RxSdYW>YJGnh|~5sX%-p2G!#}W=P)o5oU80|xpNPri{dy}Wwh<8@;~Yb zG$@C_CG4X3LyGYG~vqH3{#5x~CUZYz%v%AcV6k3<+X{vSX-jD09Q zmfrBXY7-z_nE8V=ujjF#R*g<9m4f!}Ik2HDTTa2uFlOxRC|{R2)hjVp(E!p;Yet4& z<}Y+|p{!k1_AH`l0hz3JK8^A(zKA7;G?THUlGRRgk)!)^LZy0s!NhQJ&_acIlXjGWt zRnl}HLaaOe=Zob&7yd8B{a*t?aQpeMA2h}xb@Jbf_^Fe@TfYA~WM9Yk|4NkbHq-xS z>=I6IOFr;e{lBjx{$K36FD=+r?1Sa_xoZPOW-C6~{fvHQv9$(#C%onAx4Y80%L?qb`n)*LT|rUWXq0K-PX+z8 zVl?p!K0@-{nc}%v_}MoY$K*U7(;rB~!-FIagl3wpGl$`{`vX1^*V)+Sm(>J;Z*r=} zvN6Ylev3)8jx1Gnk$~nC2(yl&VMBa6hN&idDcHeKLOwZ!jGExT8P50>DicZS4i@iBRG?Wz9y zxcpcW@bo& z=sX3!BBY@0N*f14@xAL7W{#fVH0kdje?5hh+HZTHvNcPDFH>Q`A57bPeK4t55s&BL z(;lPGuXk+_v84}&M@X81KO5e_^AdZTNETrMj$pY)5O%chW+*}VGl=j%=gOEStv;#~ z#;E4ZUj6;{sZC4Rcb-oDVO42+y!z6UNy6UtlZF2nm22(&jWTRKK>INN*-ANl$TkCV zm_Xux{t!>m;7i@6l<&r_ASp>awWct_m3?~OCl7D>1rPHZS!Sfh{NK3!<9F|bF)UU3 zgF+pI059m*>8`inLIY?4U!+Tiy!hp6-`yPTa}nn8LwP1fv`5xLf0)UaTj-Fy&A~Qb z$AElVnz@R_-G3EI{~G<2JBMG_5Nl^%p4&hVNUgr$5zM{;YAFnw=S30fc_?amT|GQA z=LQ-9#>R!t7(YpPLl#Qo_fL~en8$n2jP!fRzFN}Aapx4`E{z#~kXk&?(JoLF9b%G} z&WbdF{HuOh<(h3?;PfX4Uv?f`sbg{lskn-gQ~|vETvY(lfsGI(;4Eo10F|s=N@Oz} z+VFRb6&y$Nc~?*)ltQpS%o4M{J7We9;!kMf^X)+R^Vf=yPxrzY{qKXZkzML>vh zMEAM+0168QeH2e&R8f~yY~^X@!Zl_ItduGAn2AU8a@7dcx?!6+Vpy4lx2Augini@^ zV<+JKydCze@>-QKH>tL!&p&<$-yY1Pl^GU5<8zk9WGTIL@(?J~LwIjwJ54c#H3uM7}4lG0N5qt5+kca!V#KPVwP$;cl9>H&aD!r>$HnG@ms=hONI zLHTR>4~*tqam$Du0fIS?dm==Vd7`z=MpO&9TNQ7!-R)+GEdctmz{D-hDQUOSs%XE} zbs`BI-?x=VaXjMWoNFK9(R^_(Txt>o*H6SO{xcaA#~u-*b9i;de-|A`~$Sh_rAW% z-qaR8+;{nW+nDLZbQkM)QunWaDCvP`5WEtR$_asXvrRib^m|gXeHGcIFd>T3f4NhTW?m0$r>*aH=FmpuKj=Mc`I? z&1pCNMYzwmBC36n&9@Kw%Jk`wxPS684STwrFXCvbijNv;V6Pom%mIC@4&( z*DXvOEuzEoS7Id=K#x=6_q0C9aa(Iq&atnOREV)1)yr$dlICUpWsPzVEHbanS!t-7sFg5|Rm=jKnRLmY}fz{lJs#f6dZj^TZ^Fx$LfU+X? z4&@oSQ4NvPcUaipJrlAgp7&%0%HSOfLMEg`7&2eB(V9l|3)8vujvNJp5S*hiKkcz3 zcsArG`-a<-ZnQODCQ+HOo@^}2EqSoYO~k z;9ErC&Ow0$Z{rWR=wi)2at*Pc(Sw!Rd9c<+aAo<qgW zBiQAUy?+N_869W%f1aQhOv1K^El81K-!WdI9tsL}69o7r7zX=SZn?zGCoxgB4(M2p z%6KqaSP;SC;#xetJmTPI=gQ=8@IvwvXa@%elX}fVW}`DkabYPbFD|%dleQyCNjiOq zL_IX2>3EUmmu7`FVmzv;`vydC9l;?`t*O}L6 z$+?Xos(Vw|AHH+CtZHN)gyVYkJOC0;jY&&Nl7WO@dc3jw>!g218GzA##JPF z5jnFo<_$U3ON-j6l7*4kC@(FBX)9*5|G`D0OGRf%%1P#HGINJLG2<}$5l&xrMTbx+ zkXwekIcezc9KYiSkU4`IG$dH@Z4hn5dlg6qbs_6|DjM-OH@GnX))yr&v7w2Q84QN2 zf1Z5ENjbGJ#at>DS}aRrs@TQWbQey{_DtAi2DVuc;oDa-$lvJ#7d=uaka8m)XL4jJ zs)iED4e^WJnj~z3c#OQEMTenHQ%G{>B4GmqL(i%}E2FdyEMBit;&v)~TNa^eI26l$ zzRzf9hg_ZD1B2#FZeI6ah_uALrpy&|5POA!-Hy`ct&@1LIG+ zj&MraaNfE$JUMwo79Gi=be_79Oo+hR+qn-SCXR}Th^y3ib*!2|zHO>Uh2?*9^DQm(2H1Wq7+SQKM+2;(_nRB^JbW^ZJ z6d?$*(quidjC`I<)XOs!|5e5JkijNB!0bj~p+hMj=MF;Q2jVJSwb`$`Qjhwg+f$-q zp(<(pTm^6Q75pYGg~L*kC5jHc7}J3}x44NRc6hhx@u~I}%S9>4kc#K7<~No88f$Kf zV;=D$&i&Q-L|l$`7<%L$0D{c%?%rh=?RsI?0ht3{ihJDP^-5i{jF(%HB~3?{5HaC8 z;;V~);(+c=7FD%?eACIdtr7?~i@uiuG80{#oFwR<(cAl*))#)uv+RuS_}paSjm#*0D+YD6?DNgg)SuPXRTVf3jy1CQ-(g%*0(%nB&Qv$OFb5$y6bso7JF<%gv z)|R=y85DNC4T^364e6(h^!CR8zkCSUHwfI1gyT7%%Kad8YAD$Xf=uFBXS>PycjG5tD^lUcQ>3Bc^;i+ zVT0W;Eva#{ou?9B|07r*&T|+QzAeyU?QEBaBR(acnB8%t_G7bo?*X5VZ~&(CPkxmU z1-+NwntK19ZiLX;T0nkt^7a|4$W0?j9l1hVPk_0e00zP>ArvYGkN%hYn7LwgiX4PG zal40+)j3TRJFOz?__;3xs$ef=8)lY|MFZ0OJ*O>$yB_EC(NMXN3AP#`eIWlD!TH>l zwdN{2gqUL3%;Ks!!{Y{yS+OdjZ$wTr%vij;6Umh9+Bx8!c5>SlQ(}W_Xfu_7wdxG_ zX|8GPcGCwjhaF~O7}z_?lrGn}o_3cA!YDM}e?xNI}KBbWV@5gLolkO z{?!EYKKRg1t3YOk?H`v0?{zz4>F=n%RlUQx`cHfN4NsJIp5rn)tPPHi zjQ+SVpUE6*Rgwsk+aT8|iycTw0hWujmx0v;2|88KcG zi(*&B_QC~RXkwn)ou*$r9|n9x5?POZyDMr=g<^*#O6F`ouH`3Bwg_T=LMNXjGn4LV z0AP*n^@JfRSE@&Lnu(k;q}NM-H;Nw~Nr2pj#2YI%;8Z3#LG5i|?snXLIap^-z|cCk zu5?wkUp@gQ+^3%Su}c#p1!s{$lsOV?fty~F+5FH<{4-&qX16y-Y9~Tgg5mCVQRO3f z>bbTc4?l(2JOPBkZh&;qSs#s@muL*YZ4NsMVru6pgi{bV+GzUshxxkT8 zq%t2W%VTX3FV?|4`)y1}0(U=AFlvAB_Mll+67o$fi^Uvmf$mR`Q^PCM&-WadvTY_S=))W~Q-nGHmX?@242H2B?*|U?ThB<2%~Y;L*=Uhv%EgUmOz9(JV(}v@Qg%Q%R(sqQI;60 zLK_6|`UrnatFS{K-(0)DEm z=T{2NesHsfOR_C!UT+DfEjGkdi=kHrITbC!?7QOt_w(yAHIhVzIu@itr#v1fWS{fd zPQf?uJ(dR?9tl_HjIndx3(L-qih@O5c}z@=Oeo)pB)!iRx9X4%9Zm??Mn%Gh%4D)! z3|Z^_%-qWKp~762hc0;ee%j{&MuyLAwmR9=p^17cAZB*Y3x|f>Ij#p$9RpFbl|_cv zKOhq7Rg^$-vg+{G+No#6UzP>a)G^eTJDibSMV`lo?@Qx`m?V$F+F%5+R>v2cSfghA>2#Vt zKw%Vb7h+!6Yk@2~RMK&IR9!NTi7f*UqmD0}C(l$^1Q(B9i%n$lhcD=5l%Y(dX<9E| zta**t-4{5ViPB&6W7!ePh~ zVw2YLQ>p z&D~jqF2^fbX%YGl`o`hHu?5z4cWy$VFHme{s^3m3pwadZs+?ep`Gqq}`FZmgddwWM zJB(sK=;J%6c|wOb)iz42ntq?E#FcUxc`8d&ye%BSR^#i=NKyy(T-lQUhBF*Ihw&G` zB3NO*6Su(zyu!*$8PF3`wglqCUv?X+ic3bb(jqe-^3W0V=9g|BjV+4!xjP)a3p*wN znT0{9hKaa{uXp@IwEPf$er$ve*>Ih?qDed1b$GyL32X!={kN9g8DkkpXcA7x@xYfdY z=Mc5Wl?v7x1`T?~?XwlK1s-@{R?dMttmE`vnqpj&D?_YkhOx%2*GVILR=}L#+PwF%sk`=y@m_4Mq&Q|>0v*9Myk~xhK!x`Wm=SZ$= zZ`ENFp*CdPLre<7o|Kl9k|ejjz>ef^!;Tj>yWZIW&w-Ejb@T`^ogY!>E55%3()<#u zjC3!XwZyo)eBL>5hsOyqclI7oHHbvS7N}Lji5NY>UA&ryQNwv8r*_sWR?5b%WpNbS z*~U7sxje0dPoT?Zx-WvSQC#9ub2M&9TUIDj$55AJXXD%rb{ zBq0KG_Ep?CE*goEbE$n zv7fsZEvYwJbX=gE8;^Suqx$~Pnz4hRpLX&4H`hhDY8p{&$sQDpl#wrOVDVR*GBwzM zS&)efKMfS*%S!@r!&(br$Zv1L>)8optO*SXT%=jvxiT3?QVL*F)o=^IDO}8v()Y)1 zXOuMCrChOE*Zdze`uf1XB*@iN=$<4n1-DgEqeV@ovXiBEzV?$GprC<~~9(a5xtg}u$D2pz#IVrXCm zvRxJ0rQDB3Ny>=~EM{nkKTqBoi_-L05(jo1i1#<`8hMzYmKNVne$u?L2U&XIU64!- zWfYoSeed)bR+J7K@DD5oI~gB=YWr`oaa@%$gcS+B9@kdSC7fy+lnqrN3_1?|-|Lv)Ou(v}SInDv%}zLks(~$Mrp8F-F}+DR`c< zTL31qk0ZIu5*Q(T`Q;pPMZbKz+*Nd_pekB44p`Miztf`}ZTl2n#JMKV`8x9h#8W>*(u-sy&ZXCe>0Q+y zS;te-2=o(~1scT`+@bp*APeJGcDML*oafh*|md z4FJAL6zH~~V^7C{a#fDIA1OH43;LFdXd1bhC&UA>n!5Jf%lJpYZw=^uEF=RmYOuG~ zJQ15F*!n7BhYvz6#NP>!2F#6BBxmI+3te>NMmwky(*i4qa`TZ7u*Q zLp#3r!dnYfWvUJEmxOCb4trTn?kN;<=o=J{Kp{@fpu79~qFn$o%9W5rrjfZCUy+bm z*;KJcO0Kzw?BokWtW&Wd1vPFr8}&(ukn_e2l)3d|C`VI~>-fQ z_uFiuv;g}~@iDL@`X!ov4Biy^&2SD?trcnXyEPvgP;E)Le8HwK;LyZ!iU zYeF#5nrE@}S27B#rcbTTu);mi7$YjZr=@GoZ+Du!49OBT1=f5Itz!S>I!&4SbrbER}1opv@4TRu5f$(RKQ-cHF zG1#ovoF4*6jvW)GkXC=8=^Vf*-W6t}|7hr^3$Ad3x{?{`T8l|@(~whojCQUK>Y@}} zPWG5g&4CnlKP_M>KT``NmJ+ueMaZXgZ*g%mWl_2e1a*8dE!3+PtEaKR=7)LK!`|7+*?gbh%3ADU#=PCkDoOgC=LbPP9}h-aZPD zkTR%S%511c=Sn}?M5(2-heR_dCCV3T#XqC+JW+NK$uVeM_IMQs9XJ2+l zXHd{u0zYD-^*w8nSlelaj%}U~OB8w~clD8<>E^f^eC>}|t8Ob~67*Jh(*x}0{e94T z?lUiO8X8{`B$;>Oky#tPg(94;Uz@#7nef#453^HoRTz?QzJSA}zY?%xi3rMC5WvJg zB+~UDc^JGmhpR^ykbO2)kwc;scg0bT&SiL1|6aNC`b4Jq^M@%McY$U0!^wIL(L8kl z7-7?{zRs@#M0Ns(iI_xalChg^rAma7)R9!m*navKHCjtA?`u>|s*WO=+aua6dgM83 z{3q2H>X!)<|0SE_@EkdR&=n$q{mH+@4V}gV?=*Fqi7$_Hm^ZjI_Y;O!U!|Qo=mLUty#xZm}9AP5J7uycv^g?}oqs7;$T*+{S9)ol7Rb~jK?58(5Et;123`qs2i9`Lv{+uYg z8j4b)OZ;C8I#kbTxxUP;;3OZVniLFxp4t81eOwfrH1Fg7OJ*^_8Pay}6V27SkiQ~9E^P&=s)-DQvI_{x%IQ*V8BqV3UgZ>4L} z1zAm(KtLD=PT|r#fL00oFgxmDct=h{tyYfZgyej%P~dWvqbFi2abS1QoQ$e$p1UoGX&%*m;4hA+*8~k~Di8v4GXxKz&R%>qf~)g(Zcv%|CffLjiP^ z()<2G1YuUY1+(3xwb2XQu-)9#Ju!Q;P|EU9I}Z5*<&8wv33&6}U^&@pp5BT@Q6i_W zgST?%d^hH4D$R9D7ZJbKWM~lw%s{ECg*omj zHa}&?g)C(a-a52h4g3jb0RMXWL=dsJI@$9i0j>rYSKcKaa9jwvP$#OG)!HF^OJhTV zb;$Jfu3N`_h=jT#0?Q6tqN|h$zGecxhl65OKbsQ#0JJh__Vc)p*A7-xu^3+oW>PBs zMhnrl0e(wMSqd88>v?NCSZn}?OjI_G>=vhRnMAJ6(+^_v#hjg*dn#^gpTDgyA>pXbNd@jh!3*uzRrS3WkU#1jE+T=RmM2DH^ z=Xq8nT;&Xzd@=%o#|+?kl)TD27bDp>1sevI+=c4gE$?K#8l|(SAzx~r)60Q2x^8QH zZ|(!?X@Q4?`kpp!3Zvb0tLYoQg=KF&l}6&4E?mQR=|f=uqDPUM*@sJt3;8wXMGT&V z@9sDOdR{rh&QraZSEr}&$K8y=b&AAlasw`}DRl_l=NQ97U$hp!8=)V`?aE^WQPc?! z&Pu^!h#}>h1?`$Uc2A)Fb#%vcM@nvqrMQ|8vft@qssXhXXQ8{XjV$_8lHmTD# zB;tAi4E}esyI-tCOZ7D2!Ae*YDT~%dCZg#~xSh`Em&(7wt?{W0>X)UMRw_?;%^8re zF=>|rz@?XF#2~O6S|!Ev`&1vhDbRj8iw-ZACsruxAKb3Pf2u>wHcPskzZg*yt_gW4{6;hZlj`sQU>h*&dT2f9L7%i0TMJxZ%SD zn1)V<+jhNeps9>VuE_cGgPYFgy|J^pxS?DWk@W3#L zpBj#fG{fDfqr6n@geg=oRg8Gk5okyF=p+Kq_1Ci36Cub#xK(pL2V1OKMD-|OQ8Rxb z#B}!p$X!quo<>uRzP#|hC}zaZ%5uyv;)Z&=15en-2oTadi(J3cz?q?kdB_tT-Py(X z#}my4{xK-_?u6avHj>IQ7pvN4CmNg5)HdTNH@)wPt9c(G8@G)|EZ2xqNM-lU89)%g z+jLoxSk7<4?b*e5n}(|UdCOUh2F_ai!!;$tANqd&$yBz%w5-FAB6@u!N<}=tbG6>Y zL&-{i@{5{fUY&w^7U`?SIl$f&c7c?WUlHf$2EGHIw)leHS0M6HHEGpL>269aP#Ah3 zDv3utYJzdL?i!JQ%r;7Wzjnrp81Vj8i*|tM93yzs|A)#n{(jAuNJ|VkRbJT{)IrS` z{gWM(UbpsOo+JeI`z%RxFQOXX)WhCaP|Rc_5sr1Cjuf=r;kMfD(>$GgaZ0H(X@Zfp zm-a&|1~c9uVL4bmYx4bq!iL{Uzq(FW8@ngTK}*qe6*D`eM2cLIk=nN{X&!Ss#?+F% z;r@(UmKK!WUX96efUnc}P@r{XzUpH`w@GXK$c@-n{3->q)1ruupSr{!>if1aBt~CL zh~I>#QF$B@Fp3n*QY4nQ@NnU@A{%D^=;ws=a!_ z5_PHPlEyOf)dl#r)X6Hp6cTKdO1m_a%#f}i=GAej0^J<-adMXu^(u)prDg!MKFUzoT5bD zUv&5dw}C>$9tL~4MF-bvWEz7_knCP96BmU;!(<%F4zawp{%&vtQq!|)Th3!qTDnLF zuah9s}w0kN1aWE&^tYj%Z!iDi@uYPTG}9%Jp`AK+f015r}{Y zysy04+pAqWD8Bt_l6KurPh+f$u}gsO*2n`Ty(ELa7k|F~o6N4T-Deug-ZO#@@#@rt zc`>i>1$CHt;n7m2J1>Dgj$V(2K7vU-Go@4P4=aZ)WG}C*c|FY9;)8w(J+=Ryhj>fa{iX68oc*~CT~cyH zh~{w4ln2wKL*D!hTOXe%SdB-I^}7$Q81|kux1v2P&>Zi}I|EcQMMfgLpIG1HNj=#H zwTq|rq8}gAuLH=YS&sf1Lo!e>px_*Qn*A@L+TQ|ua~14=Ec$b9z(n8p)e*q7qBb!# zzaJ2CF;SJKk-HWr0yNm%*vNm?`A=-0PJe0(@k8;=`(Gm-o*sz5!aX@$b9P>t_c^T} zG*le;#Vl)K_P4)PAb6XEQCxe7f08w31|Ly^o-FlUo*71IajY)JFIh@bjI%SU#8 zmP+s9>-s2o`79lCX1j)OiWKGcw}_A38Q3CEwN|GRFj9*FjHsqlavJ?l#P31cen|LQ zz(>>QcaH>_uHL@)SEoZ=*7J*|$h+Inz(|zo^RCd0C!9Ul2dsXZD*|4ZJxF4x%$;6g zZDwt)pct zRImVC_U`{Ol@;tpueN*Qo%e^ME{$*Nzh(t?_+ujUKv$hK8EV6-vowvX@Lf zn0H$t@nz$s4|x}9mtKwI#1wfp=+kh!=nO!0F>P#yr?)aUAIb zz|3{~`<}Rw_$j>cgu0Jz`|td79HltkMiFRHNM{C?m6i2i&Rl~Ko+mRo)LMQTVlrq= zTD`IvQ;e>q-*l=dOVu((Il1}sZ0fF&xE7ukcptzUjPqkA>mLRSGbfjfs9i^b;Zg9*v$WaARyD3s z&DZT_C)guI?%Z4vRa`vN7r1S-{vY#fymJhHQ@ds<^*gAjA-Oe>3gG|s02mmkPltxS zpVo>h_z0AGIL9+Bo$IZN2P9r3KUb>;f5#VCt&^!hj6s{Ld%60<9U-*bq>T{yPT>4T z)J-|+dA=GPgTrF>@%GG}y`9b5KK2=l{7exA1Ri#*JAI(7J`-VJ++CN4CSTqd*2@W@`iuS+X1ZWPX%OuZk%vm39JPvv#IGMS@G#niw z9;=L6vucDxv>2rux;j*KeuRe9Tw_ZRBKm!V4eY+bJgspY1a^hz47P5*LGQ0GNkuSk z&30?hF#dUjr1!m-VL_;KC?n6ikZ71*C~#jf>+8Mby=I5E9pYiuDDAJ{vK9QpLo&7Q zA-)p#1%;k!IqO%}wr=}FV(jm>ESsDR8iIIjM8+Sl`d5T+K8Q@jcRhdkTX`QieZXaS zS&4Wc2VPvs^a`scu{%0H8Er>v&lRjX?+D(cj6t{>AR;!aY>b%yUTBgX>g4UQWDwsY zciMe}lce4JV)fZK1wZkBxLN?N!+6XZv2phh_hd9kbqZGg_Hnb6&(`oE$DhY`cvlo= z01)BrD2LrD;{kbkHpQND|49M2JWmQujOND591&&{c>*>om)H0F_n)T3lv@$y_gb2EPd_Il|q*Dn4F9yN)~N#5ue|2-F{G^yRP( z6`7SuQ(Qg^N_NiN*rYK{S}q?Fz0&RwG>CAsr3P8bw2lI;>~$wgvFe&KB`a(0u}dvT zshnVGVD=pBprn~0a;c)zkh)Lb~2`ZV;0@Su_e`$t0L9Qht<0$=IGzECZ6&0 z8J0ZgIIlD^kHQjYCd;J#1*9Ja?AXH{F{%YuN`n54*!u+BqBUX)bL6E&X^JOdM4mv| zLf9}qB`{LOa4Le*{_mi@onq|PY*)eX6zZc`ZYc+Ib8f zV;8YWk13BrzvZXY)t|0y-$KkDixRV;=s@4G=ukx4YN8agd99PZJ5`(Wd=T!5&&#f& zAQJldwh&b#?){z%Ms@Box0sn!&a^B991@~4Kfl=r7i%_@~>A)!!!}|IYI}t=m4N<$RZ%vay1S*}0WKHNAK8;~jH=5_`4FrG% z5y{km2{Mhfs0n$@;yYu())?7jtO)9szK4JPtKDC7o@;dDOmp!m<|;9G-xd+Ai(t5k zBgKI9Yo=Vfq}mmz*9Y(+Ik%*C@YPSdFfl`rfIo;bI09ZG-BG=ghfe2%=%dP${rLd! zxL<;?6xreX2PpxqJ1jDQ4~07W54TC(#&2`JGNvmEeCu4b5sG|gW=oe$C&qH3r5;79 zcK=+?*Lq-duV(spraTMc?gyGy_z^R^QMYVAt_KErzY66QD$DRl98t_yIEmTecoJlM6z;wAo-ffkl>+ta6!aF&ATI#!!K=qPiKLnFusYXBa5>6M@J|mib|sYasT(dw zCkLk$;6VCA2bcN30qDmtqBzSe2rg~t57H`=L;~PK9W8xwjs1=I9;^P^VarM}1B5Us zHbw~DG%Dodv_Rt3Dxi8v_&6aDxKW!g7SZgKcxIwWE!8b3HP>#bOt|Kb7e7rbX;FYr zyK50T_OPh|(xEffirxhf;BI~Ux*=2T(qVqEgx?en#4lhA$Y6709cEewbBy=(!o`gC zt+dWpYa!F&4TR`?@82cBreZEds{+T80{qi|y&kN=q{or}n!b*4%1IXpr#G%`Vm~~<0F#@6OJX*;CO2A$*o8=50PPKJN|m#=>61T4AH3!5vNTZ<|ETlvgN4~R$P51dFn?alF2iZSQ##J;U9{9^vwmP)oGC33ga>5+ z?cL*abW*htGUZSzzf%X4OrsJ&A?eGDJL@S@>kPJJe)&ts8>;lFt-g;nt(vw6qlvP) z{9M$E8A0YFaql1;zCbMduJ&sHj@19`_kbsSF=m~qNY1jv9CHT$CB;opbbFhzsG42t>{dDeN zjnjmYTk%PSR&|_L9+0Goj*6Oy6#Q8It=wBqQ!My%Vl%AfPv6cv3C14`Lf7bfEoKYE z8$3Y5ov>s|$X{zEVw;I070m_vkwhIvMvqFY?O{4m;xyg^_k$fPRO%RrGb3dBT*OAt zXE+j_n~sX*j5Dz!EC!Ial--e$P%-;&m}ECh!&$t31TX)z7|Vp;ENm z4!&ii8U%kg-aB}n6y|IUHZio(lpb7ptsl__r|CM~&MaSYJ1_-`zCbn2A~L`UJ#px3 zo?ZaY3A!LO7Xjnw_c}EB->`#)TmnuPH{Vx}9U}AGZ%7#_;R7*g!zFDIayT%hN*JXT zf3;w*u>1;(5Qf0#whK3t8vuC>Xc-`@goIPElWKGqj^@>ZC!NihEG)Z5dQ8WVy=U#r z=W(qD{u5+x$qO=d{}7eb;nf^-El?e%Wc8o<^EVJIdv3+H>6gF#`_r|#m$!Gp|6%GK zxFhYNt?iC&n;qM>opd@$$F`kRY}>YNTOHfB*|ENQ-t(O?PW^$}ReRt2UYKiM64AK8 zC=BoEjp#<0F{hw36$y73zjV?%tZJ9Qzqg>b<75glP;LlwAY>__Du)GaJ6U^3WTLcnJu<^&Q!Iu3DrIb^+ri5=?F6De zOU1`hQlgTOv3oF%x|>W*UL%mE@Qvgu6^qQ9Gk4wO=kg8mo8rHL2orv5j-5yxxQ!Oc z5$OwM)~RQ#{a>9`T|68FS1XzJwi8r$tAKAlIV8H6;cUU)4T#W(p8}gEN3}0^o&OKS zd6K)ka??PnfsFUi1Ek8R!8zA6hsDH5uxXWuT&qRiZ6#o!-pg#$jGJ2{0zQp^P94GF5>+wPAXs^kk>0@E&zj$}D;Jwtr-OT>6r&O?HGk-aBQMtI z%Wx<)p-QeRF%!G>sM2|95(?+o(sU+XFAB{j=uc@<;SnZ)XN<^Qte4L zbQ$F;+Oam|&Zeu|8(~FwXHdn4-9XGk3Qb~A&(TQ~st-T-aAIdIc~dtsOiW6eb*^R^ zN|mkfF%d?>Dbbay;gFyV^KCYROd`+qr3BC1@BVRuAH{n~Mu<1)bw?vq0q1Rv4Z7VW zoTNNn`d7c8UmIOSq;TkU5N&FdCO2h|8 zj)*A@KB&2;rTwl^T0%<(@|Uvf3_ca+#t)rP2sSwS+s+E-49E1dcmTLFgxZ7knVif; z3T9mtf^b?Z0~uto_O8;tO@uC}C8rBi>Fs=`lev+E^cjYu4>NoyuL`SZXvO!RiciBH zIU|$#aKP@SvK$^4B9hc?OYJWrM)|{2Uz8;tIkBW0lS#sn5B&arAcc2Pka|y=(J%k@ zC5;v@=Da>oyEHc8R|Y^R0SHY`G0^SZh*wZYSZQRqBg!c3;(5wRxS|XZ=y>fKw+jB)4d+9;5=gXu$F`e z+P{ZP{IVaFL<-j8ki+N2h~zmMxJNj#q5j}|nn{n@_zQ$oU5kwE+9N$6b`6!y_jMJL zw7Hr8gylSsZHz44H=Tz+EM=PK73k|iDBbaKd6XQ~Rchff>o4)xnr)t9deOWZMyhC| zkOn!CQa>FOxwT*5$$E4LV_h;ecz}lH^7DTOQ_54ZMXy%H zggSN&eJ<7O-Ti;Fwu7&*McF^NdzpDxa)s7l*X$1rz;RVS!DuqUhSN9eYjKYo%#8|Pr)fAtW$hNR^cy!2OE;(%M9) zq66RE3>5xA{(dkP`%*4MZuUgSBvdO@EIbU04im}CJseGFz(2>F_*lb=`W674bf_0f zSx!?LfeWO#&i8a4c}k9qZ~ZC&?pMgSQB7vDq;E7nRS&*1>zvZWoUC z(5b&zv}e9r3imN3t^dduKu=jqO2LCVw)O*~fJ1-eesGno9L-C`RVb#Yr1c_y>J1w; zSJX<3(ZcwNNNG+yZFc{26s0{3Pcgk!p# zpfg^DNJU#iGSVUTD_~+wTClHSE(QT5`cjA!qV7B}n5yf3?SaJzs%r1$Tl_!27=N1c z?g)r5_RYN6G8x7u_#v3h&qD6fvi3tUmrtbSk{jjijqsWeNumYxXZ-RMqHb&rsYoWF zEeqHtYe^u_K1>WzTcF<%j#8=d^U14$Nf9N`jtG5-J|c(H#K zORT99nCU@t1w$#kG26bPlWBohy*So&q*5WR3Z)Zz?4$4u3bA7JKULq_8odG9vUm<< zRC4)LObH^zaZyvQv%o!^e322=>D#AUk^3r~ycUW5^`p)(WpkxGb7u1W!S!!8uhjow z%&*@kC)W)PnQ-^M0ll49dp9GL5U+M4rQqD553IWZ|CPMHzF!~z57#Rz7xMpdy@LMF zfVn!!M+6es|4(KHJ~Alja?=q1fxkZh@xnDqLj69zk1FNbFuVZv*Dtu!5aN-<-Dh^j zivO5lCpRRsfAOVyC}|5Q zQ(7bYH)okt&V=_{Q(a=WP*!TglKQxX{zu?n_{ufVjv>+V=D-0fTFa)#ftm-={GXgp zB#f*&R#hzvqWKMjnX(g1wu3g%$}{%=Jn?ZC>3%fJ5=Nyh!b#KdVACg<1qUFw{$$O} z4%J8L1*apR%?D16v}PD^Xo=_778oU_&maEhA;B!@vN0I!MRe~QRJ#@G1$4v=i%94x zdF?DvDYt(-|9v=-s+bl0MF7EwN2lH44D(YqC1~y?uvcn)&r1mCC?F1m)!m5JC~c6v zJb9@Sp$0&iQ4YKqlU-(9h932Ebh-aSy-uI+N91t_h?6vb%ClXZhU<*JAFM^Q-XbpK zNv#doBg@sDS)(3lnyWen?dV0^dw)7SPm0Y6?7r%Vahr)iV*RXQ`5Ew`E26|J1VY=D z<1Vz9g8=bRTm<5W`sODIeBQCBSuw<7?$@<`Qus%S+FMFJGiURtNTd=M&oE5W87CEV5(x1iPC zSdQNz`5vtW*qyi3A*nhQq!fhUxhAiVXTn7mnul7f@N6 z3%P9IIoc?5ef_>KjGsd)t1>%=XG8L{(&%xkl@4Ch&M(8^#Gl#9Lbc1JW}Sb>&U@jJ z4*cT+;ZS}Xu|;%B$5&c|{X1pGPV77$irEslUF$?`)g>3IS|Pn$MzrR61E<^u?@yh)40>h`rTr>qGFP>yUP8Ti))9MeLSlMW`mvD=)3TxR2G)+s zQXa$*mQ=ZqY||thzCR2kqYzy3v?HdA^VF3;+X1c7`-z`~PI$!a-!3sG^S@3nOOMdY~k=ok|m(S@tgoecf!1H8@&eK`?wdseSKk_RLB%4-r4Cv?)H2d&I19P_5O#f?fd%J z)%~~?ZZn#jeuE8(pVRxpXAfny)tPMDml;sf-|xYC$G7eEo{AERLH2I+)gO8c=rh}b zkIHBy+7oWAGuR<$ym*#?Pl>`0_+6Sapf5*{CjZYn%5nwg6AD3O$KSjDwom6F(Qat8 zGOgn!>-9KR-%qBHT`%)??-~UDbQ27W`qQTyV7MLfnJb6c1HnV;Pi@94T3g*$Yo?oS zE1)ZyiqeQ;z=0*uV@MdY&E?O2!I*}RO;n?QkNV)PP24h-87ABfFq*6yzKvz!*3;#{ zIRTSj$vqg%_CDPyrabZ`2AYlrGyi%@v_e-?`~x}x8`W(!VsO%Z($;Ls!_dXdi&|r? zDSbDRb|dHR0IDF#4i*cXlTT z9Vi?blxE(MV01rV!NpX?dM!z_ON!Y4a8mEy=1Xe}8S+cAR=kUiRpwarAaET6gC;4M zjuh7utyBS`P!}$l$Kxtkvruwty4t~9&TVsC3(Vw*9IV3kw>G@$8`5ge6~(wJV|drk z2eNw;Xh-!bzbaRS*)jMyaD2)4J*T)IT4BB$ZzI5+uiNiMIM`{rBC&I4h}UQbA`8zj z@akQz1YUYr)}El=bA}(yi0q$tZTVu@8cB4}Nx$~k^W5C%gPod{)7YILO&`lcQ22TG z0$=~g1o86+I=P8VxxtgwT&;$@*H4=-_o8+6U{|@cH5kzfe9cTzfS7Sq4F~B^3T`oO zap7dPW`(jC!8luJE?$1UhkYXpCmlb>&nwOkf~{iZf^=IR_17J{prjdwOYD#Gw&7mJ zP_vpEO*h@S*H=KLY$>n_%7eI&llGRxnd|Bg=4>2i3JSf*vt2PSc^M6KZa|@=*DxGU zW=K48U?6g;>kk0c1{!zc2t&?Kd-0p^T`!)2i`$Dq$ z8b`PIvhqG>y$Yj(tfnvV+=ac|gh46|x#DUod0Hy1!;hFSe?RBt=Dr7Mt=Wp?L-f7& zN3T#9s#sQ+%}yf$ogD1)fvqot`KaEdkZ7a|I|}UJefK3Z>U67>+4_)>N{c}-gkb}8 z@TmQCsS@c49B)_RMqS24E^L8bFoTl{B)h*z3fDz5jDI4(C>u9AqZMVd$Pwj3!KQCl zpb%Nd3HdG6NjyXojj1G`FtFoa-zxoRUedagewk{9VDarA1K?fuvC>x(?3;dFCtuK= zh=z}kAC#-|_2`|O9%Z#Jit-{Lv&t~Byp1?7$o-oXRhi3)Cnl++u<&eM;_lnI*5UxF z%InA<4-a5;a10iZsLBwkO%beZ0jI@FEfO;&*1DX?_LdM5w!R=xoNhro zf&p{hT6vGFOL@ybcmYsc(jxVF-(pN=>%0!2Jgv5&3fXEZ*GKks$$PuCy?OGVA!%-h z@yI)g1hmY6aoEXRKG0Gk)QR7M61fcB%uS;|vS4=82WAZX)VI&6@V@YUh8WpuYx}ts zSsT_qo;wR)72J1 zhMrkbG<&3j4rj?s$g6tm_g^w(pl|>-ws#!pTsK_nEI}+Jh1~v(rNsK@Neej*x2Yt8 z04Z{Rr;aH5=2ri}M68M;MIqE~MM_hbLBBmRCZ{8DK5iZ`eqM#qs&H>6;}i>yO}7cT zChIMfUuIW+iIH&o`;3OCWAp=!oRX>f|6B!WCL|}Z=W*pTI0uTRLLFYmAhTB6QDqq@ z8&y!cLoHZML!+z7@O9?%<$CDc-)I6>&vc?J7H}(<8N~`y&`{EZEayHEPUqSLF~4~b zr{1moIj*Un2zev-oaE17$F?9}hez+?HC9r7S=3v5nryZa3GqF_Z%10?E4gx#2frOW z4MN?vI}st-z7EcM|y6(S{8I>ppO7X?lSza?~Oh z?-_i+V!Yj7V+9{>Xdw%ZY@|nI$PPhKk2n}Pu18MU8nYpmMTwQm&vQ@g9$gIIB8+b+3bkXs1DL37ybmjK#MpyJ1^0we@sFi6@&=X z1q+p9X95_~mL;l6$*AV5uKam1ks>gr+Jwe?wjDer(P1{!=4|6RE@}B4d@evR^4)-# z*=jq;xK&9?P5sCqhF@xQoRP+!kHJQhi22v`Jl?HkV5JelGs%tQF$jISjU3&Q1)Wyi zZlu=RN@YD8e;y|)=WJ`1=v6vBw^j?yZXhYtQZhEv5fvX_0+Z7&7a#0`4=c49OO33j zKh74wV0V_}bfpvP4GA{@#2a8RxA*?dDDCmGboD~~H^K`;X8-dpd6)6pG5n8i74$H_ zaBsOfv+<4LI1%+o%r5%k35&x6}Rf1TRrDEf_U$@;jXIEI=A6OkpPh2 zPSxRdjrfe{6fchw^^PR(3VL2A#OH}7{%9i>Fo4#WdLxX~8j9Wh!E|Yz92dUi?s)?t z)?YdY7}aUY;)BShDHey1C*5vf`qk{STJOR3#IPz>za=!|!8zyUZU=v@j0P9-EG!j( znR*Q@^y#JMNpP5vOf51Yuel80KDB57xX^vfo(t?BFyru=l_YzIA9mfd(gg|a99@R{ zy+f54B2k%9h#c7<#33aK19umQsg_#DtfCG$Z>! zVjM=<;0Vb533hKZHk53>T1;Efd>KZ_Pg$rLj*7iqlEp3fp|DDPyU7EO!;KmU88`pa zHo8Xq$lY-Ui;$htz&h3$n{5qh(2c&Y3t|Bo;DKl>$Qwv9v28d!J%zncLHv&g%sHIo z7Jy1Ol#YH63xcAVmCXrB1p9Buzx!Qz^H-=`ab}@c_A<5-bM|g5No)P+EBgVH zHv+zgL-tVvks2?Y+q>UfL%k2;(a#-UxBCJNdhHRF>I?@8KW21jQ5?QeF|$3SjJM56 zXTZtog$x`DalDcg#yxD>-RLhf7w}U#tA%f3bmpAasL#=lm@I$0JD$`2xovlrDQbkLe0;BjMqC8Kd z49yev^YfKO=zjMpP)m66*^LgPSRmgq<8stk%2lp`=ZIZ*q9Y5}+KZdkvV}#4V_0hz z!}3xMdty^{N!4ONdK3B_9PFR9L&IwEu8xrp zTQ25R>O0f%qdM754@apTVy*+X?4vg0jEXp6ks z0vsN9Q8#tx(PZ%a4ysPSMbI(>Un4j$R35NEg`j z*xWjT3g{K~uGi87zLUFY25a?o`X8^%H(R#4Te`U!ra>tbV76n&sg!8YIW#~ zvfY0WIIWR>tZTz_6N?Nz0yJE_d0CX&E)pjU^~$@)+Iu1RMs!6J=}KO(kzD15BO-|m zQVU^@k!oX#vvGIl6UCZ%91#%?mh;!ZF=8$+&F=BrP+p)=^^bV8|Q}1$&QxJ-4R=T<9LKe2O&v{aUf6@OUY{QXH?Z;z<(Ml?+sA_sNKE6P?7cC zlN*4LhFWk7njNCr#_MZ)DdDB)z`&{GyQPdB|{((pj4^5$tg7h}AbG@=$;$Be2^>8Xd^5J?}}{?MBfy zu??Kw_zFX(25%tna)y<#;q#9c?KJ9Ne>`1l$G~;TjF3tvxU@NJ>oP^RD%ou_d+pj9lETgUtx^~Z9hUT_}}hz=DR!EqeDR1(u0xq^zV z^L!`4mcrTB!31{315Rr74EG`?sMIU*_X`T7L5%Qz5$u038f~9(p3eCacNN&}IUpx< zG9wOPxnx5+%rVEAnTIXE@+tR-B01aY!Z1Ww+qZBMb8vjQS*t!uMMaZVB!hT7O73RX zz+1=rrL~bqs70TqkuO$g;fAVD_jgmSFgu?k^C2pWChIpm{?)A_*1i4{n>UM{rP~U2 zJ&d!vSx|JaxGLSwaMYFQFUhXbEU4Z1Yx`pAUX@ZTSl?HxzK-)dmKz2gOSfbSLp#DUMm(wyzP9ewmz|$Z-@;0QOGP)o&uy& z{qO{4rs~s`%0#5`*Xu#nDpIhntyF&--b6Z^=O9X{mZQktd{Qdm#l%GTYvmx8m2-#H zPsHrS%!tcb{y{rKSQh8=bjRYf+xDBu z9zCQ92sux*dEu?$2Y=jG({N|SuYPmu-^2NIIC$dM=4r=x-{vVWRY1cr!$$p_?U9ki z@4O6!>XE#oD+iS^Lsj000%50R-A7K%6JPC2T)i!zo4(d1?aCbGfFC)(TYw-E%s}=< z@RC}I#^a1*HB&GiPdW?z>gt{+sWy94e8!mvkm^JLE^cN%8%(EYs8kvCdV+$k3VX=f z=o=hg6r29uz%UGchdOE)40HNtv=>=-mn70+j0q2&UUV9HAy_vUN_qNE@#^M{?z-Be z4jVnxvKr`BQW~xx4HSYN)LFPPdTsLKWC~zPc%+VUJ&nO^X_*XPf;=d9nCS)CUIri8 zO&Dxcz)Fvj?;g{;Dk%{+%g{-68-QI%6Gp zybq4=o{8oXS&U_R=*y;2sX~)HKsjE!2h^BA!@`PW^SHzzqe0xET|D6DPo%kInd5D(P@%Do|LqXyMHvO!fx8Z08i83AEmhdbt zvIb9eCb*Jvx{r|!q*;?wRDx2=^Eldz`-b0YtC57o{KMgC98I-q1;^yxxadT8ER&Tr2}dTcZXabj%l(IM zXIC0?9n8I{JW{XKiNixVHdu**NWX}ps6TCvha1pAcN@SVC#r@N0V%3@j{9w34v2Yoey<$)Qhn1XsnNJ3)^j=~})8VwCy#4emi&S%&e{K>OToduD7^Lsi>t{PEOM`|EM1Q=n__Y)Y|mhptH%cMF($ zZV;JXW54;IRf6sGuG`%|*fPoE^mGO2yHfY#Szx~_(S!N#-~i86V;W7^5l2%$P?9-q z-m1ou2dz0oVH-l-FwrNk!Y!vVMIJ}6dSbT=ofp2$v$DgQ-2{@x67fjv2uYbv=|S~+ z1Du{z#&)e)6dPR>LW5#KZjpQ z#c%;#CXj@s4dFA`5Zbd7Vd8Y&49&HdVV-NXM;l{loYVLSg6GE!Zq9`rjsgRBf5UU0 z7qWP?6ZOb1c4+u zE(TK;6zTJ+^W+ZpMcvGR8b`iN@-rA%T&w2jfdYD_L--IvSwOW0-g9r3FX0 zW?34#2+bQ`0ccq2`fBMBV{G3vo*2#jqZe?>W~T6_i(b)tp(a4&0as3zPB7H9sDp)t ztk`h*WgkZJ%qoq$(*D{k7nSqO`~{0}zK>5zmxhF1gF#5= zi{+_H!{J^SzIqgV{3syH2D-HSi*dInE&L^gUMr}r?USkgsFz-|30bOF^K-+fON=IT z42YPtBfYlfs7R8{laULUUxt*Z#+5$)TTcXIyYR83|NZqj@IE9%O%*~c_`ldAx>AA zu|XNm6DufHx^}sb>X#353tqX9%sE|JSpx|#JkP3WwO@)yVV(0ede_V>rb*+f&;yjj zwx{w|`^l^sE&w8UEa0 zwDG73o}nPLJqVk`zOhsqcZ{LUmfz?;A=13^Uf6_N-9OWA`H;S)*+XR_js2 zx+3ldTL!*u(&_**GTNFPD48`qoI8K+8UuP&M}~&<`vV{b#H63Ew}SP6jG5Us2P5nC zCTZgDUUq-d_%UE1kmF-8F^C{6EsC;BAh<(5R7l47Bb89T{#vc9?(1AKAiOmSL?1=&eyIb-*?fU3gyf{&6LdE~tq4mEj34FRjpPP}XfKw%GB#hV+mcGVhQhiqVDC>Ci;S@% zQni0laIRADakjY6F;O4}VUEpSdRp!4YpE~%MCnv5f9qFO@6GEwPSUSl9i!QfZ`2q5 zu2AYNOM`B^qE~5|vfG#Ig~cH)EPqNQT@o%Xx}|H@s4(?d6#R!9W|x=R0GQW-U^s~V z@e&%o#7R@RYOPjGxs3lbh|N|jJ{eoGF!34^L+sEtj;X@K)3hMLsHpYeAw^7^|GeQ# zc0r!K%LtTsQ^Sbkse{*qweX7VXA`AJWw-Cs_8XMPr{22K3RJurZD(E$8>U!4L_-n9 zffBq)ML7yO?HmgE4E^mck8%t+lwvY=efK4mm&Y-T&0YW$)XKD2sIKT8nPH!sDKusaoT=zmOtLIwp;|JXlrr(%Bbv#F$=nD_a%Y8JX_n z&1~tZH}+_W=7A}jKRaqTyb04rlojM`qG@EhBLUsj0;6@)W-t;)nzjvqIgcWY^&&*Y z*JVZoNI%55O~)=Rg!VD7LnUu84)~*O?B>aSSYx51B)Mu{=J4P#RF4)~O2jh-GW=dY zI0!C2b(r;otArG$3?E8z{JodhjL8zYJ=iX0C3mH(MZ6OmOW&XMi6o7t7>FnunlC~@ z8F4U*#N}(;(BO8X+Yeu4Hj^U~`o)Yb?e1HFDVfL3h)^58C1yj-c>Y)Tf%?nAx zT668t?@Fil$ooZ^g0_ct-RS9kdR4HRM?^thsM^MLb)y#5Ix60ScI*{p}NnY$RFXysEZlcO*t`UHLdzTPsK@_x`UzvsbGS54cw3dHp~auMVF z5BiED%z1BDTmGlbFv-AcZzZm5#GX_lk*pU?#wPB$77)8&^WoNAKw6c(-l#(spNC2s zMy+;x!z`vpOF9fgYatq?Lf`19J{_=IGg|3e_5hjxU-D|yfQ3K=L#k7r`g2DY%m}f-Rea{ zC2^bXIpQDr6EE~n-{^M3**C(Z+=(u~$P zYOpXcdJ{-?I_7YNJa>uQk=ccytQ$*`8Maoloz^^3mj_H$QV@q4kI?%EoH{7z=1uay4nW_tV4ja**T)WY8q@VT{ z4nEFS9e5Ju{0+u!(Pas&N-M_*i|r9Y9?tM1o8!T2gOvssY1HOzpL8_68j<-c$%`vI z2J19L_-pLoOWHDpr%4{>f7w`>tusk9R5USWF*Jog@aTeW>4&!MqNAn{0?~d(!Q( zvP?7K{u7%&u<(lz4M>M>^pGuxkcWYnlF?^jcp+EG^5eoC+ovMz<{)IbslZ-rfMyHW zsr4TqrzonU#}Y0L7psZ5Qm)P8U0f_LM>Q$qG$)VfASWf|IsQe6t?7~wr|ac4up=?@ zEf~N%(97fZp@VFy2y7Y)f~F5(K0i$kztod4Ta@C;mOK~vi^3=3RAbBVYDtOnaCIDu zhH@;;+1^u)+3EFnf~V^j=wHZ*QAos?m9CKT{1QJ`Y$Rh=2nf*u6j-*?m}~RU2Yl!m zJbcJQdpx6>)oKrBK4>{ygT;}kTl~YB-IN&-6y54@3I3bn=l8>aI9JeDAOeHd)aT8+ z@2)`_>Up&4@-B+I^H1L=@y+SLc(#avKxQ9&y;w+5-v-y~7-Ar9TfV`CrG{XrqQ^02 zBC0iJ!DvYOuei=pKIa;ButBq^!3!g}-Q0H83N8VOB8lK%oLx+wLbmvw;zb|xFm273 z(CYDDNPoEkA0}T9yuJwCFZWo!2;sdzQ{-{mJT^p$c4NiE1(H%|xp#ggMEzGG(d{@eS2m{j2Y8t>A_4iKxLPdPH z3T+f2J1VVPm5>1M&;5jd)~Is3jDafG3?!HnlUl#W^OIIZD~KfvL13h16qpTW_tqi|SZDX4$SBq8sgK;(3__{*yU)kSmVzbLc#0c!3ergWH6 zM}~Z4#pliAIGiiB{ieD0*txZ%b5ugq^2(*o)GViWZ}R93#ScA8*Jt3NLmJ)f;2M4^71c7jval;Xjp zEW&|l&vq!!Xz~h_A-$u4ovrro%k(dNx1x@2xwz+TN?uWNHbg`yADH2b<-H!5KLn5{ z*`uJ5d;*8Q+X)d~ZpVpk3KPt9RTqVOJ@G(n47omb#L{$n1-Au#gHCRG8V-UfJf|B+qb@%@9H&(Fb}M-(;aNM;Ex^lqwi&U zqD=s{SdHq8|BV2>Mid;JkdiUoz94vU1SQ2Ge}U@XdycZgyG!LC2qS;p-(PSFnkC4C zy9YmcTkR*FIS6~;nFWj0S-%QrkL|YZho>?XgK;`{>gis!^5i1|mCrx{l$=~JORV-} z&WKA%hxJ0GrLhQ`yxVguY;<`v3iYjB24V>la@qfgB@)CGXaq)1TgJyELg3VFs|}B^ z9h0~acAReL-Dpy!uDPy^a72G=^a)++$Lj+b2Zx$Q*cpPi#4?g_obl}M*9(3$Gjnkz{!V^dd_g@ zJKskPk({vC>Wtmx(goCSnt{1eIa^ht-U%AgFxqB-&Px-c~F8?WW2CV2dycU7V zoW#$>S*sVCm(8x23oHfw5x*F&@28FCE?VBy-ST!F7I?Rmg1cGo0hjr9hcT^udM^<< zvbCh1Df^d8(|>qf%57M;j!>3vTXfol-^D~F4C|420_qOtYvBLVJ%sFc)+#AD1dthe z{dTtRPWdenyll0Hhv7~f2A|p6A@lUIZNmy^4@POr7FzHKM=R?}6>Y3Nsld_djEwcH zJ#Xi{B**=3a1W{D2mpaoh%l6KB))`IfEN%+NRGbM$J8>LUpyPBMw5qwpm$#Ng-~yd zyup%4wg)tf=IEyDUw49j(}ChiSPM+C617u^^PWasAOPr}Zq}px*x2hW&AAV&cOV`k(h#X=mm82OPU=LbZ7-PX zdr&0Zi2C3F0wx>;o(iWhNd2i8)cqyo@Dy>@50iCm-imed?m)!X-px&{%|=VU)k@7O z5FZ7JL`X;X#OM9iq_34@N#qy~Khm1&Ktc`%`Dhc{fq<89+w6%g*vLzGqa7Vbj$>_e zC;~{OL7%liFz0XpYY@;2hye>JF!;v6=5t|o9QR9TJ|Dap)=8>XP4Mc>H{{0HcftZA zns_o>M9Nt@iAHcop|M-SMnxs9n%Z@|ONsH4LcSq>X#W%0PYimNufgxiBms{XkTSKg zm+Yo>`O*x>KNbF(m}w+2!+_0W%+%p(9-C}N2*YuaQu{-K<1YzB5WS9Z`$mC+D-4Zl znMB6(4AZpc-H!iVE#rC9{ziWzwy&*nDdOP9ldz^D6nV0BXn1wR-hS71TUtHuyfpz# zs`$xV{{!{%)OIjZ%$ahtEh`m}PM(5$w1@f(Yj$0(RA{Kn#}7b%GPxidbkp_K=fN)f zum8!xF%jLyJj0aNcJ}A_ym-#{f_dmY6ga`|CFS*ijP#Ft&)JR5=aD*O-9t2Qd;`=* z)?_5;{z%FG0tfx$7Cjw^zB#`BW6kr8oFkrD=XtbYLnfaw-Xu zgli=n4#Kb0ma4(%SQWOLMU1uZ#+Teb{zfYaad9M!Bd(Rvfd`fbr;k;uysbPuoR?w8 zl{ZF)U<>;-X(xEIo?iG0mpD|LxwvZJsa86D`ZMph04y0AF_fmNy#DoeK)DaUa7q%xA?KPoQc&7S5Im12i^^*6dI-pR5kP}EZK%l(tlAJ;ej61%A zKfI|!0x)ceWorZb#jPu@!yJ$LbeHN%ZNBxU$dHn3qjz%{_9hS7o3JUu8J(z*9JDfu zgY|%GRB+Uzag~~%nn??J9z9h|&VqrTqBO93`JKVIN0@tcGivxZTR%!KorvvTd$2cG z!$QO<^rvHvv3cp?p;{i9Uy-(>y1EnX0ZwX3);&;e3{@e+9WGK^17&shH2aX4l8bF- z*xCah#1LNUE<--U=#$r3_s+|s=9=!L%h@@R%Ql|*qx-*-6k*gBrx2%9ec@SJXOanU zh1vCgLZ<#hzuw8wii#Oj>#sh7yd=~@eLiWDc+WP#t}_I)K3SF+h@w2rmb{JlTWv}5 zT~#R6+K%f=O_>*^4t>-M*06z#f`RcF%K$v&JE1ooOvtVLUn&o~{b2oGKl%9Z85kI- zwA}=J#S~L#9CZws*SS zzYD3=1|9*QLg+bT4g^qlU+ut@&oIR zQw>(%;oTeExGbNJg1K*)%@;jSdwe^kAFTn|joA@-~=4p0N6H+6YHWNY~X1GDKbhe*=c?Quy(yp@|TAlpu6pn6Rvkc9|3 zbuj|*6h-3~m|?vo=}K2gnH%2Wxen=rRT%7M-A-N0nrmlku9${a&4MeV|MGCKo98+F z4e4*!HJJD{K2sfdTeFT+)1nfzwH+N!YfF6k!4kEz7YO>Z!C63I7o2aKj+~(-!Zdf48Mzr08`hm zGL=$$zQ{jPOS7%LZD3(|E{h0Ph+Ji;7ZCBTn0qjnO{?MdE8_eptKP&=u`2HZbo&l_ zu7$B_SgXK?A}<8l^K(|sapVHLVtxf0*2TdHWBHP@pI^w01F zNf&v_bee|cmBi1P3e9yE?o^v%_CoXZs1M!$)KRTm!|#YVfM8(|B3HneIRRI%og@AQ z6zY35z|yD$r3(BL%6(hQn>&T*%|Oq!Jy(^A+)&SrV^lmvXSQ!a5^hy-ISqfzqoe)$ z!?b2fs#T{i{O@c5Dv?571XzQIAhq(y!5w1z30p+6Z$o-O!I`ZKj-_tKF+@>t{i9nA z3XgQ1FSDvRwV%pKY(y?SZf-CfU7}e?X_asBZ~Pl4SiFgXq$%8cFR*K$BA)5h2gH$1 z1Iiw%xHo#8UIi!*;1w2@=LmGSx5wg`$yhwwMH16q{(k&UE($2jEY-Kl{kwt2;u$y$ z3m`pk6lRb(m(9+;BuU1#KN&(XE?WZKM*W`zb5Lf?S7dXi6W8sd#$bK18M>_vhc^HO zuRUEKIh{3#Z!|rP6nmD9(J{%w|1Eu|K)=wl&FvT(QMXli!K?2su{5tr4T|~%*%!Qs z1xI(gJ&d(9=HMTm8=aOQj)gc4m9!XJ z?KzP`l`bowN=@G%Z$wE<`x_hw2+dkRsqSPGslJ}d_x`}Gh%3}Md%!P6svUTH_;UB~ zr3@Gxx@Azo*U?fFhNNtdGquEyPa+p?+yi<#4PxSReW1!`rUvU)2d5>4vrV^fx$g2= zK4%AbE@c`#P8N@)O9VARMC2P4Cd>+ShBi&Tx)yT2H+)RtS0;|XK{bl9vf>`G?v zP@B0vQAEp1JG#2o_3wS2D8){w6hf%U>-fR`gdL>S5=MWN`%<0mr1f%lg)^Jc8|iU5 zsAp`!enW2^4sT>s>UNVf9!~=Udr#@FUXZN6aM1jBrjGOHUVY?t-GS?F$Pbj8rBDXP z(wKU-&dVeVh^0B}Y8WJOGC6GXMUh?3mY7OGAdZZcIIhsCcbL+w+NeXkFnaI&uVY$`Jla>)mw*6J-dIf2{+J(Tn@xa!BYXIXImCrV>iyQo@ zNXKynd5oD${N)u0S%?VfftWOD73&@P)XxF6gvYLPr9Q7Hm&ZYtP;h^!qrqInea=DP zPY4kh<~}><8y2U9;qS}nb8$HN4Z#;Usi*eB2gh;uLXT<%x}o4Jz4*A9M; gQhEs zF5#J*#s=r3Lj0TWFw~~un}(}5%WhimyN%D+7%<~{UE-DQlS_8w!~mB{#vNPIV41i$ zw&RMJf>ae%Bvv`>hvCb)>V96^%c=H(>^0PY(7)}p(1*zb+JX?|+N zaXI<8lfO#VQROirIiv=PUe`hFn*8&fYrB6FQv+^jS7Hxz*xbHKKt{IbAniWoAxA=D zg~L*Lgin%C7EI}e_V3u4OKtGH(7DMDo6m$CpAyUL{e?^4j4#rPmgDb9v|(p05_WZq z1VRw-{glZ<^Mli?9`cNKi!fZ{LSD%x4 z^_dQ@&*CUZkZY$(k`(oZ2ZzO_1G`~!GY3-Wv%xZtXF}bIJ)O-$d5%7r?5kOMQht(F z&d0II%V|JMjQ_Or&8W5{11HJ|(4yms#}x&%3>}IZn6ER{GF6HjzRAu9}PmX#R{am)lUUBN1)Dx1|2Icvf}TDhzL3N2iDg2(;)i( zd1$NkMEwj(;nQLM`kmnzcnBY5Zt!qaAdQzNq;7?_)y1IDx;he@LbBB|gIR4CF2bK51LWruE<>zjlenVjL6rZ(D_c#PIP2jO;^!r2q9b{2_A&}Co?oZfu{ZO4yA)XKqF zFn>12?NeZI=hj&AYb$JS)f;oBkHHarCk!p(fI`J`WAdo^sTSfom#U4t-X5q{DuZyJ zzf65(s#+Lqscj%7#@owTa2G)LS-hC(=ECXK!?0mWceHKa9f1)pa7;*o|Jzu2<}8G5 zBif-$=Zv?u%7j(qPmt z=TL0SK2#B{MZ1pe(X3k+6dke%wK67aM^Zaiq)nrMU9nooY2%I3rEH;e^gtRLDcrN= z!`5N#(Ya$+bQ`rDZ6~inQF?m@Q+ZOvZCOmg&}r0c1qh|wM66Oivmkj<=hvTGBx?C7=8#sGypd0IJj{APUS82i>AVMaG(%aBZF zS$;BwB1LQXnw-sLu`%0?8+6bZ#E_d#i6QWyBTChx`17rpn59u2hFAWHaLt_x)J$^TK38VQI%!SYgG_3=5aAF6#WR;0rR&`1*kB z;FTTO|7J4&1%8tZFj@V~rkniAEo7Ww3HvDy2@zs58E2%3J0WHQcBq{)QrDabhE&yaD(=jBaxFO~^poFQ>c zBam?hFBoQb;eeXY8ad0KpP7E;9ka5OmStBI7a9iWBsmM4(BKuVT z|0JPeLdOb$_4n`mS;@E+R#+i``U0yBxfOpJJS+Dj79@R7e9LU56;@bbg%wshPTWrX$T)Be9 zix&$gll{!#1xc4KT|$WxC4^b>pOKJr9@);lYSpU3!Z$0d_>o|fnt#fM+zKnKu)>PJ z2S1*WTW83BIR4b4&VK=THlG)D{)l6szZX(2>a@a&9|_(wnH6a(A-BQ`E3EkciyunJ zm++!a?(eO3vgqlxTe6VK`HeYy-{o_aAOz_XJP|-v}uFM~dhE3X`Yv;~r z(W@=?T#FLiKS#jX#aOuQp81ZU$A-Z}aqUAGw*RsU@4lFDS7F_t-nbWMzWvLH#)RfI zFktmn^F45Eau+n~y9yz%Z(zj^AG7QC#s`e**bYliJVJD2IF&XTu}}7+L6!RG+_fv( zw`qwPdv4?2uEp4P^(9XJx&XH$%pOxA7*o2Agy~#PGYo2c2#cYMD6F5o67Nl}e*z&G zR;4;xckYVLRDT^ibi&0qUrqe0FsNb>7M*CmGei9fV@LKw%XY0XZR<_JDf-<(bZFca zy;^j`b|2G;rm@8 zIH4~#?cars2U51JuOSX&JCDP2^WFc3w-{8RD%z0T+O%#hm~L4~xfNDeVTBcc6$T@3 zduYW^i9KshA^OEDTz+UGND%>#@G>L@fwz6|F40tNk+1yl=*35Y>>2q46*Ksd7Xf+= zRkG>wN5TKfF%;{*6zex`z|IB3uzFk=w@6 zI*7{;f=mGgL}B&(**J1BAe92+nJW{{FE^!gfBzapg@ohcy->PKz_F7)C|th$f{PJhFZ|#a5GK^OA=SHMxiIBGO>xDmw8C{Vs6D(F zW8ud2*s*h`VDD`;;reS3iHwlY?~h@GTw;WRe&18|5mVXrwiHWRbFt{&|qxNKUEi{r6-?`KD)9Sn)^TNu9rkkc-5Sm=7NL znIW8dXTJVNq4CF-51u%)z9%+s*(W$jq*6#Je^P}4b~Ym1U)}?QCho(rtuxW7-!dX~ zt#B%e$ljG1$lGKVg-~Ny?H0K6gEtuwQ@&i&rJ*YkBzDfiG5T@A=g_+CFT(Sn{j<3ul5xe|HbiP3|4qDj|Dc$TPvot-_Lr0+1Q)j+&6YA~%>q0dIN{&hd**Wu&yoe`fP zhHLy2T=36^s#z!jmqN%Ba~pod$g@>whM~PX!9B&cluO1>MWJ?+Q82S(>W(RM3*=H9 z$9p2iYp-R+$|>bYQGEqOpF*g6OV~W$jDhnn;l+^&XxMB3CXDKjrtOB{0|kw}wiRtU zw8!9KQ{W#N3ny~BG`l0l%sz}G>nEb;u$35GzYT8CnECGTaFpn_hJ3_hX#G}LJbxnw z_8*Qujp;o+ol~eJWOxuSLR7Q_AGACu{&rqC&muuyB7{Ur z@H&zDy+6qN*JW!`F#b$AIG+EV+%a*c{^f%N5uaw{$jvCmeR4~p>u=8!hbRA(ulRTg z9z~14J1H0HC{cnvR7ZDW#E^gI`2QSC_5LATf;Xh&o9aDTo*H`pWOSblBaB)xeCe6- zAI-NF{}%jZLM{?XVdv-odwYA~r<8wwl${ww#&t=Ncpnx=q+ALcJ6qBw|73S6lEBuS zj)S8k92`v7HlLk-_`g6R(IX`I9W>N2eVIEEZ z7;K2ptr^h{y?S&*i`HXMVcc3|x1sbSOvKKpjz?4iF;0UH_F2nf_M%OgQz-${m+ptH zjgmSw1EM42Ap39~i+o?8a_@c^+@~^>By%nCyb7JiW7FaJxVhl~#c>+_Hu$4vr+R4K zrZ%=r>y0e&f30t z(_!0aHg;{IK&+0%Ta7&yteAz&&-dYO!I2m>x*s;oX@V6imf`xTO?cp448te) zL5)gT@$}FtJT5*4qeiixM)+m!Dm3od3$@z!MAvQ;P^(O7jPFp!oF9@24TMsK4IHU0 zJ5pPgn%fm`(h(OK4N>T03}1K;D|YV0FROdQpypX>BQz2_beTL0`!~17!tooBr&&)_ zY0wevOJ~RX_dMHcKv<*-ou|yj{!J~ha_%9#IK2XwojYR7x~1sbG6&vAq%;PRBj)7| zbn4a@J$iIPgXYUHhDa*jtj8|_u1)-f`#)@ zxoHnHYu6ja(pg>%5h-4*oJC=N-_}6?i71vq1Qoqgmf?usGt0-5q$CyP*o2qcC*XK& zHsrPqMR@odJWotHD{X_)MRUN{=LX)TcSq$K4Uur>8g3okgS=h3!bKH|h&T ztbqB;HlvR61QDCkJHy; zaqHwoyzqaEr1v-RJbfWNKD!LYS{*TROgrSrm~vG;kr0Ut_FR8XPXFNSI1vESqgBFw1lyUu5Sa$n*zK!5BZ>L|B zLr=rVji)jkc_G6sBIa^R;A>%+c&bz)#8bbdq%e1%%Wyhe1cf>8CM3&(-6TZdShh^a zO!6`Lk<&Y|?~xRVR98gT%+J2eBgetdBt%R@LZvtpLb9T3i@Pb^&+jex(v9^-IklNR zJ_9uz?iLdABJL{r~x_dU763_o>sh;y(ui zw~4<1CgVm;0Os}`h%w{FVfff_IQB3aHvDFO2C3W@Z!RxKzsZN;kyeex<7eY(gzno( zIgxQgQUK-;8iLW3)~FF9Fq+aEHGC*mp7i@pq+9}f=THo5(iKl*cqTe!-k6N*aC+q; z+zP?pLdp+qK8oCV?6CXj1C%f1iq$*cLaIzYGF_jP2#uX5T+H`rl^PW4Gz5_=r(%_{ zCC+xxV)(pWC{wDW*~gEADlrZ%M=r&xRm-ty({>E4o*o9Rmbw*F(=r+iBu_C6dOgx- z%_+FKXLN-#DR4%i^AVBswTSkrjH{bQBks;6Y+W`T=RQQi*47SLJjshz2Zccdbwn6G z#D2v2WBah{#7op_-4u4(L^yf4;`cTo(y3I))?gHzj}5?@+Xc|Fv2(HVC|nJV8#G3{7ERzuZA!NK&erL&QK_ANKytkIJ?7LXznsdG+JnMYUn5~L532OJe}Oqnf=Hi)#(rw5rcHu zGO+_}9nukz5iZTp!Xa~E%vrh|Yu2nrog#?{drxd5HVX2z8O?q?kxmg$a!7)km%HF1 zck`e!#zIYU)qidirGJC5?b;xw^eF5c(2!m&1ze1gW}9#gB6Vp%I!FqbG88TIKbVQ1I1;K$Hr2|UHJjjH zCbES#F&?4xmSh!n8&yJK>j+&!9Q2M}V6}lqNq2b?N^~EFx3h;}r&AvsZ14^}r|(Cp z%5|}7_a0Q&yuraeOR;{h$sXPWJ#5ouN7v?c(7H|Af5>Eoi7MdpNRDOifl=kv7+YF{ zoHj;kOWc%1NYavQi3CVV#_@Emqbv%ffZnA9y5}G9LMW(l&Lu)0K+36xp3y4-o!%6N zl|&}LOxoFh61k@)4MfZ+4EyEh>_0WhpgYP2$H#H&>4u;4zicTaB|^$`IUG(+1TT?( z{P{m6q~z}`k-eG)bg1a9ha;6Oj+mL2;u8FF0$g5lOP+}|xw8y7Us}3NCPdUbQIMn< z30|lTsF6#Hz9qFtOKwb}_!*Z+&9X=lhKcM2QVe#!6ANZ!QYn#o@}DT=C0Vu>SqQSF za?c{!z9#akp=%*u1RdqOW)8jZ#fHnAKtGm>VYsc8xA$$^v!mbs;Eb6hg2 zMD}BP->4j%hWVW}jf+DIOxN-uHPaT4Qs6^`Qv^0oBLG6|YO}rjp=IX2P zJ+Tryp5;cZqU9jDw-zy(%A#z)M%cV;H!9YyV2<_2f%Bu65FHjPV9V171Y6faNT)u5 zwcB=L@wO9Yf}qFYtsAj_-%gBLb{n-DRYG)F1XMaL5)(8?dVK|>7w>_CyEk-+2@n}% z)EP(9AWISIwTOv`gvh-)`j<`vjiW1(IyEAqxqb|Yii!I))A}X!h>wm$5*(3F@c^&0 z6eqU?3X>oZ=J3dPG;UiTr+*!S_1jjU?XX^W8KFUZylI9%PsPdz-7y=Nd>&xw)YZse zyAv*M8H2qKLy;|gCPapZB5$SY2-!XpmwnmKD&(rt3Nl?RViQb+T&WGlwgcuxi3GhS z3DME1SF37>JhEMUVpJs5nM$E+t^kZ!umKxZY{c6r6}4MEVxyyp(h{^uh>1%gW!Di2 zuP);1!>340N+KUR;?l`}A|qo_s7VXNADo8GyLV&$!7HS|rfjcT#K$H=A-rk|^c^}7 zTPKYL3baJQz%|%*{4P!{9f4QwEzzi1B?NDpg{!w7;Mb|^kgIYtxHvoD$<-qyFUxFp zA_kPng~hKjBfs)3)~sBCU`;Oc>!QQR@tbjQ;VeX!Z;K*49Y@gXREUc=QS}ln24K?I z5$Hdz2hyf3i;iWo3+@)=s#pORj_gC;%B6+-isjvLIm`o9sp%z>f*O~ohE^3%@tN)G zS*fw}!ssTpm@sAmcC1^9bI<%Cb}5G1c2_ZH^9|fQya-3%7ekezRgrXQJ&gIPqguaO z*t+5nYFEyT852gsUuy?<2PdfbQ_3e85%RlDik zXp~Kln~xM2eNB#~J~G6SpZ)jbn0HH#={MwvA%E{b$S~hmjzu@+m~u;oz*sR}MvAf4 zSAkux#fXlP;um`M%M}H-1WTYKBD(IH0<*~PxN~xRB=SN33t-Z8_a*tI_~(=VCC?;~ zn7RRhsK``e^f{`;vfFZ8dnd!#i!!L_xhzSH;pb(bKadk42?~;74#hG1yc}m@MMQW^ zq=bojM3e*%VnjIgK#tu(VjR0G$IM#_45zrr8MhuQFy=ZbCcZL6Qhs<8;p&Ksm0$(M zxtP+Pa8ZsRCedcH!-VMaYbnAK#aMY;f$^v4IT0{h3U`&_n?qq{T#@62j{Ta#Fgd&R zR*Z|!Wte?aig>vQx1Y%{!$(f#Qs4uHeMe>{Og-9{zgc9@a$T5lJcPoj;Kob5=k`w1;I^`vf($&O^G2yfl)5+~2bw8;HIYCQg zde=RYCHdL*UW`{%ucIH)I89xKg4)siv!t{UVdQY!_U=&IxF0OVRLc8nlGEEDDJD~1 zCsG@^ZO+4Xk|XC~2IqmoS!SlW-8_9E#{ddDn|>!k#ZZ!bS5P~fO|lwuQznqvE3YNO z7lwH^6!3|rwoGN5b5(&J^jt~gck?AB4n>eWRT7M*I`Jo2%%eQ~N^O1mT^STqN0Uw} zg*I>?Sd7RhdQSBbsxULc*nA+vSXCwm!5I_pZ zuTRBrQW$Z|pX&KK)!hX-G?Y&z#dCq)vx}7eRC*7VQhIafebJKNcxse$>D`)kR*3^) zBo`9kIX`+%ex_5|c`^P~lKXg)(Tdyj&XT-^W?;pC4wAC_mC}fOdJ3nXr$P5t`EdQX z4+_+%18;i+w$2%d*=u%V>t#PYKf4#wTosYU&6Y^U1&my995w2cqh5jrdyx!j+}+`o z-T^na?t)i~VW^eQ4N8Sv_=L25?f^_%vKJ4+?NPgCW^5Te2#4EUR@Bp?-xv*zZM4%9)@42 zJ+j)r!h%^FaPQR<1buKonPPUBKCCyEuQ`U;bh#+3JG3T^iy0+n4ZM?SXDX z2O)DB84A^?g=!@Wz|B4fnpCZf;zcskU}B2qd*b!$*T|G9qd-Kw3YJ3tJelEalOiFx z2dY)hg;${lG;H4sRf=UpmK+68r9d_!$Kfd2wm<6TOovQ`iy&9_94Jz}Aadp}iBjol zaQPUIN?j+RW-b?GDpDLdvSgqE!4btu=12Mro~YiaB4S>>fyUkoZMrmqi;WYC6)uDf zo~GGb3tqi?g>2b)wp59{#fu`NcRJ)MQ6F_G6hIm~R}?N*fYL00B6%|-dyxt#naLLK zLbPZ_dCQwE1Bw=;^e9fLM}Ab#Z^XTuuVE}y2NOG%M)m@wAdCHgaD7G$9@~%dl@nF- z8FBYUAW*mtCUq(en=~0wD1RQLqk1e-yfAcP2jt0OnrTH zB#R2Aku$S5a_7qpB~_lciwq~OgrZ09)+kcCC^BXAg48ZON)^wGOkO!qB9}YVc3Dxc zK}C`QrCGW-GP56h@>3!ovSi3Y<#7S%-uB~NymqOC=B3h`Q?)~Z(j`s)`8G`sl*^kD z4jFQxY0VsXe&YcGor_`0ur_c{p9hum=y3OXAjHM$VPc0;P^8O^Y_4+HrOgZvd!Al1 z!aY|B)GD4CdOa!9)IQQ@FNBg6s>Alp3q;6sW9ZP?x_bQ+w`bittQG8&Hx%?DUU@^qi#i#feVywnNX-e4&=yN6#4RHgS(Rw-uVh5 zcjl}pSfc?vH9^pMmPEgvZIPYYP>nie5$byt&voh1Zy42|lN3ekR!7xhdEnxd3k|DO zLE!?~QIYcYJ~$8#*=l1{zZxm>L&{x|+(fSQ^bSZ-uwX%`)#`5|<=h8cyLJs(vu1_2 zx3}5#OK_i|)9HRYPI8tJ3E2=JL4$l+%8^)@!DJ%$;*A_{TIISwZnF`}3j zf&L0Sk?BzdZD^orV+IbtXgosbMj7I!= zTY_=b)o7W?AdpI)b!Tv|m&M(HB5ryVbpy5%2`xeG#EJ64UZgq+))A>2RacD?RB@Z1 zi%>6*9!j+YyIzS=HZ2fDMDW}r2^x}OQPEzEDZWxP%1yGRICw(V$-#&~B7cplC8468 zh`T?qs*Vb_p>iBk8<9Ryf?c^&*^n3k)rzg*;k{Jz+q7Zv(UxDbIrH62wTCU5i0Q^mzM9 zifDHorkB+smdM&;nE^GkkZj!y$WQV;N#v?fQ4KC|pGi8dA8$XXMCVfckka5TTZ$JeAFX%FbUij7bu# ze<{K*4OFNom15LG5h^>2a90gfPjA2n(nKFp<}+xeh;`Lq0@b@8$u!1QhlCJ`K)xeL z^LcC3V`_N~%DYiPH4^N611zEXs^K8QjC&H4rg~fbN`x_GHPD60aVpLT?<7(V9krNP zMh9t%Hf+Vu2kw*kl=AP5OShi=Z;BYtCd=ds$PF4i3;Kv0xzb|SxZZf3r90NFS%w_` zn=yRTLnv6q7CP`mTswXqu_6T?tQ&%Df%&j##bS(ZQX4s)6R>vIRX902`~(ZC`?@gQIZlc>)5joxw{*2`pJY3!?K& zu`jF`R&AIE^}bm+Km(W|IsnIyUqpqjbFgYeO)MBc4WUF%*iuEWp-!r5JIwuME@n>| zjO%mzkdAr1O;$ASKM;Mpwm|W$CWDRi`O6@8TI$tF)`cpT5@vgT zG`tFxCuQKvX5^fu0@^okfLwX=pg;zDD4esPWR3D@+`c0zQ^I~A$X22RTop>>DOpIc zVa!~z20FBFgUURz6LOR+0~aQ5B72l9lg~6OXXAy{{05Xn zItzm*fgLlF4BgqN-WkP8w6$SPf09<`=FR3YW~E z(zU=fYkp)Vf}W*VakxrU*t>c)4xhS-L%U9+>8Or^dcRsH{m2q-4~r*9iI2nGJ?Sa+Ii47Y!RVL5r5H(5`(4 zWD(?(2DQ6%M5k``A&B1$nVmN&CMI*5PmnmGROvh>1tAqEZ>7t?-rS~T)SfC7H<_m> zU9+GdDIIp6d5|ZgX&r%g{=&%U!0l3ra&_CGVZ{|E|rbZSwm< zZLe^7QZBfklA~y)5<>c7k6dWowmq6PEcID_Y*4ykW3-|&wr}75pD|hC{(8oAPdzPSt-ao849?n|MiG%Pcn!b~iY`Xvu#xcFYod{)@0#?tk$ zMU#u80WK1w;LZvI(>XSu;69Vh8bJ9EB+}zYr27I9xmLM}0H&NDqHs)zc}+~1(MeXsUDTnTE6ZIK?Fk0;kck|rjnlI$=CMOuBCK&Ly)Z;XWogy-`I3odd#vV z8JkR2lEHFpT~v!lw{6hjtQ=2>K+DLD!6s~_@@U{dgst&G1G zSw^lzj?)uiR*{lZo4Vrrkz(wBB1X$%I*<5(P!pArfvNMULIP#J55={4O%E2Zv+#Xo& z8vYnZ@fWAT?bHhqiV*>q#fxz#N`y+DMqGLQOr*{q$3L_^-P?wH@;6=4ya5Ws;YiGcRD%FP_yGI08M-z}*bhXCBHYo0)LC zVsoI(8MUZDjjzs5TkHrTAyYedGG;GrxZ%*$+v`CAiS6-n>qteg{Z{Kf0L_|W3 zlc&!?BuT{4gNKn6_69fo!l86>MU~2x;o#whylLH0phyuorAY%9dZVJ_lIYDbB3qe; zD3!?`UIoe^SIkZLe2|$sLx~(V>QMYLv33`zMHN1>i{XhmWkrXCWFNi#GZiEk>L}uI_ z3~(Sa(z&<>eGBPO)KP@(_hhJEMvcxyh`gxZVtZyib+rQVB)=Ico`P9)=w4ETwwd*i zYlwIh(BNP*72<;AxJcwj`0_?Sk%q|HYcYCNQlotVouKe=G@n43VIs}5s;tE&srZvU z<@2Ki!ct{&H`*BBLGNpwf?D*XH0u+wV&aohs!TeW2sshC{}4tI(epQ?G{{LQVWR)} z2TC@nxcO8L_v{+k^h{f^9K{-%WK2StWFRM_R$g1BIcMpoKe~MLS&K!rInTx1qU0w zsotqxauH!qL!|sc7!Ua(gi$?Eh*aQp)D#7bQDVH6uzw@!<qbshD1jUq6aahLryuq!>1?tU@P} ze_F~EhvhnAr3j>~q$e2^&#prcYG*Ao8el{6PEoxAv1YeGHfM1$2w(G}xs3GSKF@-4 zKIk?=Xam5_5K`u;oZPlJEmmqcko?0C@OeRFa zKxHwSO95_lV)GmeXTnH5mVJ)OXqG(!s}|41o3t%aA)6gE{B7&^KxuFRq;e&_8#2@$ zw;r9#IUz}-BQno>aO>#>;MsL8U6bC){;5M{81*{Si*95cI6YjQ_4Hy=hb+-xR?kjQ z*O-F++c%(I(R9%A>^!}3yycN8O&XARk)_@ly_ar4Ik!0BW%^&hvf`PxsHmu)`WGJ` z4-LsSGBOg;(a~S^^H2X05)y+pZ`u`;r3jG9pt%aGGTSW}jDL{UZrFl+ohiZHkZLob!zOcOo&1 zPAf3=x(u=mT2yy3n$8NKpMeN`hs;JyKc&QcUl|m(M(T-$N2VW%#)Chg(2dAej}{q3 z7<*EQlSH`E^UNU;TRXWPgNy61=%Ny1&nU6|oyC^g1Rh45IbMp)#Z`woj#OSM&;A4h zhUC%n##3-$V#NuXp{1J|d9`@?T!v{E74W06#D)A>{G`kqFZg4b*%L|1;Gsu{bRzVp z_=k}^@5P!H0t)h`z?E`n@!VfdaS}ncGs20PC`D#Nsr)Qk3(`>7yFv)WaiQiiu|w z2&BTfQJfBx&O>Tf6DXge%vzKoWsmFMnaZz;lVB{pE4((NJSnl6Cp z-RV7Wr8Y)+7)s^$i#NAF$_t5AFj-l8PmVB>X^PjtivQ=}aYQtH`4;2E)^!oD;wJxX z5KENMgdaqO>U(kH#R1sq5};CRAg30!tAA4*&oBh*2NcGVK5YO)ka6$+BX7^4$eW}wOZV`)B|-qnqY>{B^>Bf0-9b2F|}e8%4MvB0e)|w zo?a7AtE|MF_SvwbUkhBxHwH_3l*Ie{H=)g55?(~)`DOYV45XwuJ3GV9PWWK{1@`XU zi;EX8V#tso0^$9c!KV_wc<};RvSblv$^WU@!QTVhcRhXj6nXOGftJ@GSYgEv0=NGH z1qvW8F7BI%Irjl`=gvj7YSmDxR4KFTmtf^wrBeN2oXI;`2wX@wK!taz;PIc0IXF1m zVhhh{bmx7_dG?uih+sdw#h*x+;WYVS|8_(=cqa>XB-8X z(oZ11#vjf2nP7%OZv2erVR>GKi6gu4q(%azqh!+vBEp;=f2!rRKnauv`{kKr6VElp z!Ey2IBIlC{ooOcyN{jp{DNSK^n0^z0bVR`oq_Abbl+@w@U&M)Vkx1==1#&*J{ zx=Li?MSkt*8JiB7U@CnQ<)1I?NM5WsaC}eSOX2LQM|_YRi(+(GT}m&^ZVO)(C_Kl@ zN(3)LWm$i!clyiqN=~2hCPXfzMd9d{XL?x_yfcVUZz>4}Un0_7OAWRr(F^_=rn=xS zA1bPQZWsK7-9FC)mz|j<=OJaCazaV;vy`3FPoy&16S?NLDzqC4&vEeH|KyGCO=)uZ)l^;%Cp@FHS$Q>?lv&!FDWAMk z5Ir`vF}e_ZaCyw}v00Z8sTDsBxWDK2W@~FU)BKK@y!7B-Bjh5n4Ek7KjGc59Q-2)} zg+WajHMz^Q;g~;VG#-V}3tYS<7LI6#z>6!e)+a3%O)iPiZD*m;v^gm30pVoF{dXe} zZ29zB~+|fQD~SyE6$xeCy*X1toYGj zrH>WqZ!zQg-h|u)(;#j^azA8oO@3~=`rLnNx6f(7m-i{}7+;Ief-hrF{WKZB7l#R7 z#$k!wgp^?zUyCKR%jcoLOo{Pj7z>i0TS9(41&iC)t}OUH7tq@ zKSGvP{QL1k3Hjpvf89ihiD+U%YBJ6+8uUcc69oI+L?WvE+@Mnv8Rzd-M9LG0+%kKm z2Wleb>@Pl1MFUVAv<}74uT=@?RQz%DYoIVhjz5uch7gY_y#&e++ps75N$KBookWA2 zd)`{;*svg?Bcmw{Jr`EySn_5R^2_^B^RxK41R=aZr$GV@x=Cs+40EPxl&v1tQ;8vmS1Fd>SJlHgLPnEa-G_9cwM=kz}hp1Boc>rFY9Ka?U$ zEyhuQ35;g*jIZObru8#`92ewMLgB> zkD$D4uJON+@vsO9u0@c1==x^|o7(&+#l{LN{t!g;sXPA}G*=_EDk&;;>W$**c!uT2 zy%J2UU2|1KhlWK2a{bdHF&L*W-}tnSCi1l(UWUXX@U{=$CHy>HM(7h??AW{!n>KF5 z+C6&_^BW?Keg7B_Uq+bkOn7nQ2EtSc@Huq}(O(ovkLTB~2n&J!H)wJD>4)1*Z`coeEXB49QpbVjvx0)UX!K`!^s^-g+)^qB!oP}{w*X2s*{Zy z)?wHFTjZ+79g?{v%WwS7z$fqnKHQ^pW6h5L7)+$_WsnSGE+{bHM}et#WWp(e{ETh3 z1-o17;iIFZxJrbaZKW;l$uQkBS(h2bxJTqt%=X6Qo(#4ZHv6Mr>Jfuy#zi=KQ-Mb| zdQ?dR+<7a-@mEa9O}4Y9Fsb8{7(P$SlxO~Z3AWRB_pXEL| z9n-xfKgsg^JU=Es$@#T_WG)rqFvtsYIX=!LCH*~H{iep958jO6^7@ca2QA+;aj zC-|`-g}eD@ap%)K!y}})!GxUJ!q>}Ug%wr^F!Hj~a}VZ!C1hv=HW>foT{yKE6G6KG4C@-X4{+pH@k<6l?nR#p$<3q)FpI9kto{6I58)w>ustnQ#9xA~B(HT{M`!%Y3iH zls?tasM{i_?cCsK$LsLF0hayEeh(@AygiA5D~=*ZRy(YmHU^<7np>FfPK;Y}5q3@v zP{`%5wX=uM#u-?BCJ?S}X+E7Eml{DB-(eV1@<3zk6O5g+iLUshTRY*?@SnqLAC z(hD=E3Xw?IfBZ!>5nf&#M?{U=l!$tJi#zZB!Q_cIqz#A?BOq2x%F}ZSA4<=JG8#pAPH6=v zh)7vU9fwgb!fT43%kV*EI<8zvX>!@wEuQ3NDzAxrt0+!B(mjyk(^Fgqy619yq_Dg| zG$dSt2$2Ey3L_lpmylp8XFTPBO*~@AUreGHZz(UILK8&-agHT-mL-3i<^{fyQZD7A)4HIfA|Rc8_D}HQhMwjM&SgL7ju$azX4wF%Mqv_u<96Ky2S;%0u+Sv)JVu0oycbU<~uas(B+Zd+!Z; zB84rHcpI4>Z~cRW?)~}Ut(Y`&EEcTd=L$GF*yH}OLl{3|EKWa-lP#k@edI8XGZ8F%$hU|3uY|CufLuq2S+&Dig9T3S_~gD4FM!D|8r~c3+3a`!#4;I z{y;Bt5)Lg{jh$PTVCdj!cy6xy2gg@o)R<{lGix~x+`-9pxR$8hX9!%b?ZkZ=^@}zcgbCyNBYg_e|ML8LT#wFz z+6wBuXOB!i;cAgkkahEZ6|@Kn=e&xgNG2y=`(5 zd!t6Za=38HG#h{R&@&XxQVo(6)9~Dm3s!1?Mva@JZQJ%}(x8Cg?&R)<54X;u+4%EV zyYo0oyEwooR|=%;9|sA^St`QycM>G20QWQoP!kajr#ToT!394#Houh!giuB#?ew6_o3V$M!7A2Xy;o(~;uD_SyJcV8ITq4YDGlnT3ospWOB6q{a1;S(Ukif2+`-)aUE{P(cT*gfK1#6X zjvUuwnHZqt&d zNofcOmSM|FDQ=RCSG}P6&`HqafD-#DKPM>9OJDL4?jmfVy4XarJNR4*-*7Q}s2&do zOK^_zxrOTM(+(|Ep7 z7_Ysgz%6>gZD|Mzru;6aw8KNCn0;H0)0Dqy_obwaiZJJ*0v{gKfsK}5Q_ZE!wB*10pqhCt|>?gH*Qxn7rv0(tQ852dN-e*x=&Mb=bFe57y4=gOJ>vkluI) zE7vfI1S0R9#JbZjNQqFu@0ma9bR7qq3(GNn{|(sN+Q3E}i7kt^AR+h^Dh@r08ohhL z^vQyX-tl@3Gu%|V1znSwj5(m%E`}2v`8O- z*5me|aQSk`TeJjf)T)Dg*>j*q@m%KouyQ5F?S1pmscR=R>(~oE;Uq_?1PZwphZZcx z%h*VaY&!xO8Vy0K@`+eHZv%z0L&)1e$a2<3pW>nDHsUzEOIAeQLS;}puNdp*tV0YE zFmLcUBxP@cz9mA@YtjiM1nfk=Wq}wtq7S4m)?)qnlqMoXQB&)9|{ zog2c|a2>5jokfF@<1nd_JBAFMfG6ixV9GgL^qDjQP0~I``$>n9w|FHKEmA6g){vBQ}aqtUf%XS8Y248u3G$%-BHPcNZP$Kj9_YlV`Q z19X29E}=FW(5D>9*I$N#$89k05ffzz)<2X8CpYGHGh&C2R4`?d>BU&@CqYKD`|evr zx`~7yi8EkMSq+AlP@``V9X#zQ&XQ`Bb1|5=;4{sX*3G9wUJ9Fo!rmYfn@Ep%@ZdE< zj*fa1a5kb|AuSqs8ij4^Y^ZLw6S;GC)+3KQDXc`EUlCE{*;ihtliyp9j1GGAEu}^& z2Ql`(7NK`(HD(pnW6M1m)I{V=sdFOq7Mt}p(`2s*FG4AGsR0#p@iF#VeEcZIv5!DL z7d>1gVr+ga5w^8sa2{P<^=O<~kMvGP*lNYNA0@&~B8Z-(#56CWL31yIu#KGsyvRSN zHy|o|@?Sy+CmnA?NHQeH zj=A;NM@j+jPkA^%f)=?AICfWtVntNcM`{rlBtx)i%NCRD=^x8SF@?f_jwQ4xL+wCV zq)Gqt%(+6z?izA8LM41@F#R|j&yX8Pp;_xEMrLYL*`0w+H)X;prtHTGE37bsG+Zko z{|Vua2PH0CdWd=*dn1EKPD~py8@b&jNMEQhD&%rRTN8ewTz@=bbynFNnxf-@0KQvG`ZG^;U*Wu{lg*0hBDgE?FWAA`0p2?;$ z8kGU1+DyQv^_#G7^D2~bBXY%~mxzd{gCj(*AKFIR-}{ucMHTtlALosr(f4K-@k zC&exW>o9{qAS+~X*mmL^+IOr6+`54H!flYxO#-LlT~Jiyi_4duB5&j7aFmNtws`|2 zKEDDx7f-mSOK*-P8Ta;$MbD+raNzuEs$Lzn4eh7FSFe{6X*6B)?n9Pg`OvayczORC zhWG4`TX%M2=ApZSy9ru2=PHM-o7Z6Tww>g65@=i(h#i|@q{P+T>v8|)P7E8g0Iz)y zU{4T{ZHWP{*-IgPfFHK+y?}}}E5lZ!N@b9vPK-m{p-ZuT{YLEAvmd{7EJ3b`h_%Ux z-51Xw*NstFbkX#chW9K^-E;mE)WWp)vX{FKiyEo0s=5Y`pUB`J3&c|Xc#=}3)MIiv z9Uo9An3Y5kArstf^q5j!2VH^~>4>PZc>$lG$TOL|54Es&w?#M^vMw1M>=KYn`L}HoL^2{k!JHqH^M}A|7EDo!np?8|<%oIXch$@632SXBF%MC(4 zr9^BMlvm!LI$5eF(+57?g=hQuu(t{YHK;^41CA;2tDh8!8uBfpXB5^ey%v3P5or_> zqcT&NyHDkqNW_>e#}wp`^Vz$S3d#?pNS{z*_j@+=VE-miYQkYHd^~y>$w@((OH>h)pXN!v5SutiBZnu|W%A zH%^TPYPwKnD28H00Nah3jIsT?qDk$JNavs>Vy;TX4^o2(c^r*Y6;R;)EF2WqKxRiR z;*+!_Pu`YOhk|*$aP2J5=xeZT-&z{1v^1~_!i7i1ba-{sN4S1}+ZP6p+z5L29xeJz z#O4_-v1af9sM2J_8y~ZuJ3cVD=YmMDg37#GkXDm~=oHp8M!gn^RQ8n6YcU`Np41AMwP4H$u~<-LPU(Bg~(;5y)2T< zYHBCMh7uoO-34bHJG&Ee7p%w0HGQyZ&K4pHMkGknVMx6s3|Mj>^(q%eT)cU=Co_zC zJz^tx!3L#8b)X`piRq)l)eSk*x?}0O=~&agKCV+eR&P`qN7il<7N3Wa^28<`0u%XL zVT3{_#=h4QusC9gh}zm4;pRvRDls8XcLVBX)d>nYzZ*KG0a+=d>DWDs4lYEh+=u`M z2g(sdq6?2Df)-C@P>T`4a;6q%v8gsDi4j1Iy;&X|ic#IMz4hns8 zJhsGbF;;uZ3j1Rs$TPES z!w!uYrvv%;auI@JMW|R%h3#eaI2s^gnb#o_cxToM zGD*Yal$y;G@;{(*5=LbKjs=SaB548Zio#L*6h{^}J*X=}#q4^NN@D<9407CB>XWq; zrZ5SaWm1F6nMXlorXLe!;jkbgt9eNd3L?t&&2kV?c+1v$Ts~GxJX{QT6DY$6y8aj= z!80QNIjA1JsVsFeQGIa_@Y!h1gq(kDsuc230+m4w-}h8bx)<`s`Tq=hV#3wEfDtF; zC|#J}JtGQH{x1ZIkwoeGQNeQCQBstT&_pp_zm?!M5p-_dtl(H=Y60ipQdX{0Es^gy z`kj9z5!So#E-gk|Ju*|<%U~``8uH7V2Jd+w$0L=Mlv`ni0D74uW$QJaTq%DJXt)=( z;)j6uuH=2oc`@48@Z`x81O)}5PMtc4dU_epoXVkN`CQ;*{vEut;=%dD$X*~f9K7K5p%}~=xdG>IT!&Ms0q9sd3*sa1BSYCXC|$BBKHPkPRs-4#$3=f{yng)} znKEU9ghsH4fJac|uZ4W+l8K(wAu~KRCoy)#DR_A2M!GyDQ7WSjkIz5C$pfqL$g3`< zbg6?6kDnrArAp8Re?-aVwQzs^9Q?ZJ2&Bb^VtU6i2zvY&S*zAXI$0u~J&i=AdW}&p zj~4S6EW^HQzQ|v@1xlnRA`zH?npH{(gN6mKUcExLY}x2ajn_}!qez`fa3=!iTCxsG zW)tDXGd0SU&47?t2XyM+5y8h6V&>A#u+LEuHHu}1e{dpdRW1p~oJC+fHy^uC`eFCY zNKBhD9$BR?F=ys4*mXP@9mmf_gNBu$KQkA*PLLm;DDpD~X+^sB3Yn&dkLFw ziO{riULkMV*pGOpNsG!Qi3yky`ymkUE(n)|k4RgqIr`VK#mv!D@E~4-#}8HL*{?o= z9=#^zr#kG^VR-z(0gY>xMZnp$c&N#Y^tN&ouU-Nl9tELPgX*v)KYs7*(7s&`_V~tP%A`@qnZXuEc5H$yS5@RrYeNk^7HgL-LzF~`#}|)a^Oh~} ztlSQ5>$_lX->gT8nTFzC_Co49RT$ocJECf(JVe%{kny%5avh%gt5B~_3E>EK z6ZE)u_z3o0IEy2P4q@-k?J(r7gj}KsY~8&TCyyV&{{06Krjo#|R1-8So>^Ep=$gSB z*GU=4S13CaUPVx*dJepK1hj2Z9>GtZB1_ep$YA=A18sa54sP9wqi2re;QswMe(4s< z)~|(7k|)c@#wj<-c)Y=e>qd0!Hw?CK*J0MLo3QW39kgxSloZBqJH&_kfNR&TkE*TH30ppxg$bXFgAwuJGHiJ+L3$4Z(vs4V z-XOuUyHZ>a7o$~iHHy0$kxwSV+`BSd{2)O_cReyHO>yw4k=dM$IP*-7^Fb2GNlC~{ zWlwx3!!`j?21=o!dMuX4D4gFR$d6?HmSmoh;?Ck| zgkzFasKr!^uZ5h$6W-i3duJ_E_U6uI-Pe_E2>I%<=Sq+qzn4aiS< z){-*VC7S`O?#XeA+N$0`kD|^Z9C|8+OIjVWDny^YoLFJS&kpXBf5aIq7k!`c!9ZJ$ z6I<8$(+2}t@$L9w2Lowi5v_5A^Vg&OVfZf|43roi4Y`}MaHRKd;amKC8)C3(@+#zM z*9q=EzoN%!7hK&u!u;&dA@0R_%-Z__!@5_%+QA)Q?6wo5tFbA~A44A-1C^r_QZ}!| zFe;<__bB84A24y|qx1j%gMmy(&RbIDITbcN5ljZmj>1eY{pI>%(v#9%O+Pm0ARa5s z)|#!R*h;}1mnH4wbl4xes)$JPwFyRHaV>ukVZP1ru^%>JVABP@W@4RsKWkGMOIm!q zyCocd>_|SMosl|yj*HDjOp7q-n$qF41bvQzu^*nzO+JR6!ip#kPRtD9>j*t&vkFFP z|3)D$w(c^?z+@_8@yj#XoCe3o<~@R04_yn{p$BY7&1KWlGfqa>&4%OS$Ml@#o-(ZI z+LV7wU2uLl>D2YbF<4-dpI|y;zNX*;I4=Ggk(_@EOmaNxtAxL^2E#}}$qFm} z4fvr411&l5sV}$U-w4^?PsabNu>A(2{VjgJ4Njz$QKbbB5oEpCUI;wz$Zz5 z?#_Oh_$8X%_#{t_nkNpGN&NsYjgTSx}WDi8JwQPR*wc5 zjDlieaZ8;}vV1M|&9m&5Jf}p;vZRy~*O3s8;^B6cvMiSR;&4_nZiN+Q(7RwItc3jUz@M=p*P3^o_*ua-E&s~zaQK||1&n^R#;($6;}LRuoCkB2l!!&I{zVDxNt#O)X6i^ zKP$fXqE0KU_${!~7at#QCFE9EVTBd{kMW}kxz&c;ia!l*lt1IlxD{4dVTBb|SYgG# z57wjet@sYmY1L5kK{R~c^q+y5(`(fl%Vlc(Xwq*qK*L)b{3z&k(EP?W0tTJdBr}yt zSZHN|PNOmJobV<7kG*pMkQ{mY@H5?G@2t&P+qP}nwr$&*wQXZ&ZEF@YJGR;WD(P7q z|EIm%yRV~t!XN~MxiepPwvtzT{g8BqUH8U8Qyq72l=>!#E5n$Rg_QlwAl zq9Tci_!H(sKRWkczcqfnB&120<- z6is}WB;8nmOOcxRrRbX5>nF1G#1q_lwCB)=@4+tG_$mF=sOD6z*NHy8deNpwBNpy^ zCx`!-S4Sr@ZpE#XH3=Y$o6*S|^eDEgEtwI%V|_6G4w+S!p!$RLVM{ z3@cHz;Y2>{glwZ7|nY+)NjP5%P;xx>KVyjonPbwH%b($M$bOI>C&k^^AA7d z=GqCYJoA!EYgY0o;^%~)7yW8>A|z!^MiaxM7hd8=3_BKYCg^wTMIYMd%txER9BU09kr~5udVd#FO4NJAXO%_{TJBGDV!Vk&Dx6kh%N1lr`AV zwHj_uQ&xV&t0PlH`iiC&xw*lc*&wG?+xa{X zH#aVD>G}(zR1g;)ZR}Y!Boi5B^wg3V9!%0V>;RSs^LjY;h|;B|}R`v>coe;m_+=uZfYBvpywFFL_FAUG!^iow>>_&mcLjM5ONrUU_~*o?%^} zj(TN`^VXQJSBE$7A!}_0)l1Eg_D#9`?#mdBq^Kxdn@wi-j-4Dhe2l4WOA{aFPe`m8 z^@k0iL~5xp^!R*u%}4KG!os9|4MYWn5*i%KyLZNWBHHsfZF`O;ROL+95k1Hxc8iaQ zA|k|>*Pgzg`-yc4p}cwXp5Op+4<&uwm`g-$o15)>wzF&3ZVqi2%EBQlMN>(j3gpqn z%UpWwWn34iBVKaz^i^)ZGfLxECuY)T=GTJSfZM3qlpL~wqX$mmbbJcOd}CNL?kv+z zY-9bgd0byO7r7MGY7&&;1cgZRI;Noez?$`Y_$aRV577`76hX?QnqX%x${{l4{6aZ( z)1J)FZu3@N7q?M}KXE_op#Mx{3 z(6@AcLjAmn{VJXK@KEA@Za#7oCQO(xVd76<66D`2v5z>Nkc&f``f_;J0XayiP#{gE zuQ0d7&N7)(Q@XP5v_GM*j?uUGbf)*{!0`YGKQ{^2)(fOW7}ByIZ@=-FFr~Q#NwKl= zZ$t14l#W?3gr22yx8-t}-|y1(YhiIvRV@>B@N=hUy! ziuGHL^FA_Bj`Krw*kvt6M@vsmg$WV+{5+Y;b|sgK9f9|D(0$4&l0RN$@W@f@-0#NF z*%R^cy+^}ZZP>i?94{Z8reCM=ypM|J#DX!*Kkmc(6Pp=6Z8Im=tzi1>^Qgn_(zioO zocUu}eD(t`L<1n?#S>1SI)QI^1RhU5$wjcRHs|G;^~_s1k4du^@B#$)?wkj4j zYR35}xUy(0GuG_j$m$8ys4`6KG0Lrie~$SPV9)Q;DWh z0#iG5=E|E0ULBZ2uc_zIhTfuYmq~cX#&BfzD3*!i2l~9j`}IRSMShK#(R=GDMwhS> ziFxr_m7YQtA9)m>n}Q+;GLc{RR+JNDE?$Gqt(xGh{nS86WX7b;v>830{26UO&pK$t zlBB>_%$U7|IdkT+c=9sB67*P$EfH6D5!-AM=f>KI@_Hi2Rw~WqSpt6!D_aL{?3}|Q zQTEfPOk(vp>AKk9qzhwUtHyYw9?#moWsQ-gbiS$~6-wnVrfb542@@tv{86OAqJNJd zmuzGH);F1%cq#vT+ZtYHw(#6Pn%i#!@j9`LYso?~e3~a(VU9)EQc4UJP(AL&g^0d-wl?IE1U~Y%JMUmZ=HiMdxQAjeq znI+Bo4Q0lZV=>D|k0P})8I^N3rcE7)%gghG zRv$;#PA!-}r!yz^Y{J*)5uQp*a#tx$iw;$JcWy7ywI>+k%Qt~4mR!_!)6=~D9E$v%0A&0$aHt3C`x3wA_%76#VJ{HZ&rSllMa1i#^ z3dyP&3&)J~9W|6C%i6GS`5|)DZ9~~=O{iZa2eENUB4q;xD;N5X8O~A>=ji5(JUz7? z|Dpq#HF+%kJ69wo{%dba7Q}i#U}*QAbnV)Tid{D|d)qX4<;H$hQ_*m0%g}jCNWQ&{ z1KSUyYA}h;9h$Rnb~_GkTT7{0t*OR|SC zD?uq8^g3~!ga-eNQd}SDI+-wG!h{JEe(h%W>WI{uuAT6Brz_U zK8p^seb-)2>~^Dh9wllaz%?lYJmcey{+SJWA#Q9P5c?M%6&e>7w234z28ieo`X=v2(L`Fvv5^6@r{zFNlNW#KKiuB89 zlM+c+aTGZ`2C&hy3iS#*kgV1jk1ZCx5LwdfqY{!UM`p>$^9^BK9HE2Ts5zUWw(W29ta#N&G z0lBAF5_-ls;^<<3gJ^ikIZD)u(vs5FVQYFDFS8)^#E+=_`grlE}^vJ@ct?%w3)xd$zD+$6+S6wa5L!J4tzpcHbwLmQrI{Trnvf z5iTKB9MaKL$%$yc8jvazcAIWZhf!QK&gR!EDhkwzEXp8^mgeyU=rWMTSzZxH_p;yb=??wmA{UwsE9zfz0H~>q@4g`NZR3A@+{p(i1h6a@i4VQI=+| zDvoKD9HNrP!KiDBJAM+g=FDN*?0H;$7cT_VPyJGx zTiWo^V>SJ!9w&V|HCq<0=0lVaIln`cn_DUIx_XeAQ>Qa$?kpybTZ50r42z%X1y?97 z(L}h@w$)TrO6z~!C+5W02f1WcpQVFZ(XmqpM$8<;t8H`mm>{*DgizD#(55NEfO6qX znZB1JTjy~pwl)oO6~HO+0uH%KlD&Ngo}GO_)q3SqQvH^gp_Y{1SJ-8&K*>}d%viXB zt>>O%W2r=GY0bSOyI8$+0ps@v(WX^()M}0Fquop?1Y^h}rp{f)h2qf0TxGP4WYyLi@^1-AgBqmX`5zz-C{9)i z*JdfpgvL5XjGw{MwR;Im&`4Y5D6*Bj)Jtoo$I?0j=7Co^cKr!TYjbf!n#<3zw)pxP73mmsB&LYs=6y$UZ}So~`MT0XcZii6Pq1m)X!OMf z(7ID|^vCCN@W@#vP2EfFmR-r1Aq(%X@8`bXCsUz#1~#e7nYb(@KHM+LYZ9;Hb24sh zCdTwzz?yN>v1`+xLMe}}LFzd-GafvD)#mi*)|oba+mSs-d72c;B!?T3OH3+JBcg$0 zVQtBsBjZsuUcvBgZRpUxJ#&XtV(aQXD4m@-v}7g=L|rju@?_k-zTBVY)^^<5y?})a z<}!1Js85z`5V^KNVbCI3-W2M;oi^&d^xgW9CR0}seR2@f=gelplpzG%;|ucg|!geQg4(RwZVcn$Hp=8crNZ9ZB5VmV`#l_3FR_cp%7x-QoJ0@ zB#|i#y96{k(Mk}a+Qv#jLZb8{HN)D`l7qdfus6*Jmi8*f%cDzJ;*pL6M`w{n9LP+Y zM3P#Eg^fLyqHd4&J4lU2C%N)yJ2pbdS=-o({D>ENvN4{OSeJYBg&0YQPY}Y-cwXO% z-!n0gHYu8Dtu<*JzV!Nr1P99Y)&>iE%;F+Zq)CUZSv=1#UctvKGi552BE3jDF)9SL zby}Q-NR0{#!6{?uOA`Z0Gh!x$2cmPxgrnRo`vqNm055$L$R_fjx3D9X zRT5!=u|!6PVU;yMIbE!Y2?@bEU0M=DBXLfjhQ#2Hybq1TC1U}yrZpGagT(fXSea=E z35p|KMi+56sCf7KJ&6hnT=V6{7B#_P@nlHrl5%7tUnU095fLoX&yW^FLM+MV4%l01 z2n|UhwTlIj@sKu^EpegVd^TOKoM#b%7Q@^OL&qwX`O9JjPS)L)`|i-)641URdGZlC`s$` zr5iUnHWH1cBg92vlh&EHcOIe4ngeIwQ&b)NfR_)~5gQnaQ>Jt%b@2p7K&Eu|g!#QC z(JDO-W;#-(O+`dt7^za?1V<}LXBEk<7s2E!ke72)T63Y`Ja+b%8YL21aZMs|k>aO> zLvpU+Q%_(&sKhdVAxO zpiPRw=c7MK@u7H}n2oVSZOZ#kAWhL53oa%4({E-8>VAHvaF*^=Ki&*!{< z%|ACWkOEuVufGoIND^iLbJdx`+zMUfTTY(2PsTFUsgO4vTAi`M_;(;3-&!=xzaV|R zF(W?kJ^sn|eFlW#z>W-N}!BlzT=%EVjb%GHz2 z51*nvG=axidoZMFPOhw+!s|Q(=~46n73v=2%HuuQ$9uDM-ZWnLT2p7>FnZQ-<+5t(m@r}DpX8eg@)bw^TnDP;$Xsb|j=4d@$IvLUvG|+>&L> z=91>&IwtOUjg^hmg(X$giCj8(k|?ZrwR0Sso@Hdt;(7F~QGpC*!E8Qs8%Jj+o}N2M zq;(GLd5c%Fe!WSI|96n?Zx#2h+@}7(1#DU|je8pgvF}*| zHddBcC=DbhC8HPjl7*!eS|1PYdSzqS)FIR@l@o(jB?P}lh-C{T4^C#%V$jOtKg=yG zG3YcTtF+>`LYs{E2L+)w&o{@URA3b_R z!GZ37EuRk37Jejf1+m;b66pWp`gfL$- zYEGHQ@RI&Ct+5cxlIcl&0xNIccgEz*Nj|#j6{F2@7|3x zOBYMCa)oK&7D2y4i6s4a$b|_LCQSUzeA6ECm4Bv(TzXMxk_itDB+9x7Cok?IzpaiW zz0@O;l5xqtTmEGFL!?ifTD?wALi%8;)2MLDUz3(O!q~ELAs?JtP(7c+52o@~C&g21 z;1Z4=+Ct{w1Gt@kE-HE}4C2M5ko*OU7nIa1^Mluy5Fa}9#72hT;}u7X=?f{C#g$!$ z*OFiHmQGbGbM~VK>wkEVlXQWl@{(S_-}{o3lq8D3okTOQxz^6CEi=X!BP{hAoT!r}dCQoAvEdat5e2?w6< zp3m9v5^USHft*1*S#>6e79+Y-u0$IStzX2Oc|!;;KAat!Ch~0AcWn|6#X9jgvt$T#qo=33LCWsf43JZG$yZSc6 zqtH~`1{GmV|2Dj>vWCH_x6*HSHXfX4O3n1mnQ-?ZwugE$_DM+&tn9{Xk9*{(Se1n9 zb12AR#m-j(?=T{$wVJR{2F zA#uQcHZ*xf(W-~J@4c6UJ?e75%v@IYEk(%7Cq(OFiLfe0jXVZ=l`cb(^|$F$*qWqo zSnL1SY{=c+-Kkcs+CL~n{x_E|UzU3zO_=!B{4+M>DLv$cYf@+LZ9*4U;%45t?4Q(_ zV-uRQ>~%(}7jYprDw0awX3;v^4XQTr;PSo2OekN1j}==|&?cGKI2C=y4`P1nDNMex zmwblTG;(cE)=sTRt%*ZxlZoM-^V6xzC63)%f}{UoYIc0Yg3*pFzMhx;i&`L6)0UCP z$e(8hO-D3Gkr;zj#$t>Z&=o6v5=u*3g6}P*$&?tLUY?PXe^Kv^8NnkV+U;!N$Xa)5 z_pOg2LF}8U7{dp4BbAjX2UQ}XJz&Cw2^0S~-(?TE^y%A7nVM21^PozICm|^btq`5b z31+mPv!0AEm(sRvSDt0-%+hX!QP^arX#Vs_UKR_MErFFLnG$_h(LUpSx^?WzxLuc| zM9ERS0l5klr>?6r$+CZC`DpS)DydydkT<;zNeQty6z$CNiOtwJb_Ur;EywlgW_k`< zLAF|L$e-2%otX=zOXo!uXAt>WgTvifv}x6b(HpOmIjapjCiJCwn?5L;&7wn52YKQe z6Tcm)fuYrY-`|j>Jen}^-^L*O=C`zUVCc3Js1J>0=PMn#a=VbFP*Y~in!~actEgGn zL3S0X(@Nf~l;p{vCV!o=%$zfy<+G+!AYC#^$!g?DQt-=yFpu6f~l4PL(qY&o7*jLNM3H5TZ&$b{8v#OrOU5g-aRTz6KU%Up&4@?+nS_ zTp}?sQL5GDXH=(Eqj$+kRwoOFO8YL7_N|GXB7u7z=kbZR`0Rqzgb5QS{>%KK9&!mY zh2+!LTplQ@I%k{YFj4Iz)#(PeG~9>=H1g51i+ zl9My0^HkK~c6r)T-Ef3C=e$Cwsu1Mnyt}xc{kPxAlY1nK##V<8qsgBk zCE{0vy}rof=zP?zkS!&|z>U58$<(L;A5LARc!%bs{ekw-a(&MpvbE?+cH^X(zl$$| zJdvYo)}t!goc2|6$=lwX-ocfq>~yTP?Jg@0?Y9kOqB5a9OA0J3T;ZJhv*l~ z-u0N_1G^x(7QcODH@dvJi1e|dX`>YX>fujtyQ-&G8?mm9K>(tn%uFUWOWjW?{o;tl+%g^KWlj})ztxpzD z5ArqYLVSGeuZZU_{B?p{>VJ^tZb(9DWh3_@E5tu>kx^K?q{m7dOGreV)N?^p1Nl2?}as8AA;wOBg1kV;&xc%g`` z#QiGGs+%m*v9Yto+>k_QSS)&l13|je1q_vf$ z{8AGqhF+tQC$W+`aqMg@#l9h*_q8`Sh&&}=Zf%b=<<)=ZZD7L0pFd?$ijLK5Xdd8w2BQ(|1=j|lQRb30LC_Cwq~Ur{Zq zg3EJya4CB~T(*tCWz{u$6_9$TlSxurWAjP5{7rl<$hS1j&AocN8B-?}v0?5Ep8blG zXIJpUX?oz%ww|o~*p+S5tEYtM7*nz|MGxMkwR0R6sZ)y=@7E+SvUn+)-gqO#YD&=W z;ENy+rioKVt~FXp%$^ZqT}6+I_8g7sjqmGqXrmHvN%iyBvfcMOX;VVqwS0)-k;O zGUh$H#MAK&@GZND9%=5;YeOIx_Dtsf{&}p}wT>q?qj_;)Xv*Gjaz;biEJ;OJ?CviO zkNfk;H^~;y3&Zf+-kcocqdDPzibnbD=~Ar-&Byg)lbecjhesLXzgkV!{u=zQ4PjK% z$~ZNeNt;?(2)=fRNk_uDd}<|bH8YbmFMu&WqlxdV>B!=@4Olv&JaGxhC@nLQ-!+iB zS%+}M&mEr=6KK6b2>sI=I9wwOgD&|CK^`N?&i~0@Daa)x4>|@>zkEXKrI*dMB$u?( zG{xctBAK;FNNLGpSpF>BPnpE?1o`JT zLuqMA;qv9loi`sPD)pd%?lC?epR;JuVR?Jl&3!C8>x+HrG$eXmXYROO3|(;)4NB}C z9C0v@;qb=2#E7`p)-Gd6pZ<)QbX2Ta;ox9{`*t__ckRLUn?7=S{+AB2da)a8mdxX! zueev#@0mSy7PH1o#Qmd`%8${Lt!O<8guTT}tZ4)8VwPQMhPNo-v( zjBee#vf}VXk`ug`Gi?^L$4=$WM}LmY?9J?%i|IXhCeH#z^iVIBj~Ypzu0uI+!CwR< zvTte+=FD6o;>_Zm$j0_1^Lh8^75n!tV%L#_%-(%p#51BWx5P;_(43u}aCAvS76%0u z;`%z;8o01=6R(p+if^tkY+!e$44cfb;oHStsc^E;uyw@(y0-1hy*Ti^xRt$I*Rbc_ zYtC#vO1$`Q&9L#TTt1U7ZTfK|OgfsL^P8s8yZ64JyXOv&R$CIA+vcG4IW37H?QL1RBl#mq4bfQ4w8Khk7J8RGCS+%(HK)RaO2v*mjY=KM|5+eu*4Z$ZMgb?3I zQn@%2`f?|?oH{VIUtJ31DM*c;Q|XrJ3ELh7%JUuk(uV-0g|&QroSeks=!A3nR8lA| zX`Hx!cr#tyG`OGIfHY^TnU$!RjjHk=;cGE2A&YSdA+#k?|4EEXd@Z;oAuetI|SrQAq2@rCb5kem2K%)>(jSmdK}+q!t2+Dy0zv-ou9DlD*1 zdQblmyJ@j}ISZ!u<>k@2Jo7xy*@sEIIJlgZ2W~<9bJpFD!}Wi6{{AVfZ0tC`dIrmv zE@9fp-WY0+C#Qucr_Vl;x5s~Y$oa>CSXw9uh}AKCfg6<~&M;>CCG2diu~Niy^@Il+ zzl*e4evRg1#!}fak{}@@HL66EuJu_vtu1S3Z4jwFqwnO?G#J>6LG6k$W9S$nlH=HZ zK5H4fen2oyHTTM3(D1POuG&PC|{%~-RhS~$&V!X6nNb^#mZ&NS-NHuFJeW5OCdzL zg`T^|P7x9v!0^7yX)SW9X#<8wr5t&-9W>ycjEs@JxT;>))SsBowA#bidAo$W@oZEFLleLzhXIELbb{!km zuVwYVE3!+}(AQq%DpNis4I^dBjDO(pZlF)W*Pn(OBm z$?>-itb#>@0k~fZz$P)0JkBvBWzEE!n7nM8(pHZ1SMs&V%C7cBxmRNogR58*hXbVw z<|5f=Cyo32aOv!1f)7onpLZjceM=WpUT!Rs8ZgIbB7AyTyzzk+m*qf){tPHhQ*WH(RKKC zJcMBUnlC0Resrxcj)m7JGquNNoD53FZ|y*jItN&^ARjZ2r>9KBMpBK~M>kR4G7%nB z?sbS8$5wHFWgpf$k7R4t0zx(3rBeH?c&>Q`Za2Fehq0-1K8U+Z zl`ebOGcp&WE@kAv%(nEbU7m5r?~pI$@&{gC!jLn$IlQE~F+gx(c26D`ABKL_IEu~~ z%bXdPxpj7q*z%UD<<{YGcLE&>b!FwtbENZeqfnnDo}4N}?GA_WI6RSV6$UW>_DV(- z>B92oB96Bk#fIxy+3X2>Y=*O;gDd`fr!mC87DvZaH6B!?-7I?-1{^+$Iug=+EzV2o6FcQ4gNhq>`I@`yyK>lk5(|5a>-m`% zG{`!LO@1EiY*B!KmM2-=B@b&FyVCFYyT9FJMS6L^fB#-~x%f+QOqek7??C!emN+jowzb=w{uoL$JCDbol`)}zttWH*y$X|hu&=^m%OwCKa1a_WU0rJHob_P{tE z7i_|?QDvAoek*nAezMp8b|ecSk}+Rt@)j&6i*X61ZD!1(ALAby&cV}{5x20o(ezyQ zxK2z`JiGVYp=|YXB*estR=zkVwT>9?`*=iWWZi}}xccnlLe1S-c*g6g!p)D zvel$ffxPsZvzU3~`%|-IL()1*9xf7orIS)G@)(WUydZ@W+_>UggVYvD#3rcFige@R zRaC89kh6QX5)$dng0-{p4AG!UN|N`^QOK3Ir;ib@g(oM^VwblHw=W$ed!qpyTrq@8 zs~2IDqX_TL7~?!Xbq1?k}a`mbhKKL5blhA9$absgs){JOX$*472RB>_Q zphYOJeZ-Mh;k>(WihzhXQGx~%MH$E`invK?$<#wZQgi^xs%UwlCcV^K@+pownS_L7 z3RJ6v=b>GMM}@KPya!g6Uwg*Upfj_kSn=%S&RvGZ(|fUW+(IZ*6WgZ;cpD7~FZS_7 zUy3S~^Yil5aiq?T`zOwcb1aLMxq*m4pRdYZ&#qB57<48xD`xj4+Q$bhOVFx<4?Eoh zh<$dRH(6^?EX6onuh+<4jwG7R*pK^}{kZL3M8N{BnfjF&mndDi7zf-olCzHSo~~0X zflYTZ(8Cw(~!gHDV8+voD6XWri4eDn>KLdA`(KpF-xVec;Pk8a3;4=NgWsW0sy z)ztF7e;3kA;nb;9@(V%|?xw}Gn3jLHA3WIm#DadUDjGNHqgl3O8x>3CATD)jtR9@gp>=->_#b8dn%ij8Igq(`G6 zkes6y4KuvJZR;D7)gRFnYsBQvwYj`@4Ou&M*UAGl1k!kmU3hEq3tJS%tIV`y(6W3FI-2le?+B}qlU6=!BJX_?T68+OC;NuouK)M?t~m$z=0ddgb5Maw9`mx6}8~Z ziU~XoO-qQvfng&Ck<;=$Q|7u+v&T4UxH^l=p1}H9<9HSCjI)KFIMI0QG-V|vZSFID z%t15?I~tA{L6uxa)1rjnJM1}^OrP#wH5^rbtXO-Wej{3v^1UL3Xf`caN1b64$RTl z`dr<{-r$0a?@(4Wl(oeF&2A5+V@dT!mo8mWLQI%2@o&b>&5a&CddScHukrhO$PKcc zwoY#*n+GZs1}sH2r4j4@B&HtnpECXX^0M;Z<@cJb{C4!{42r*f;*9^7e#oUBY0LlN z!{oQb`AtMKf4~&dHS0+FhnrXvU6nJ7x~FXWeZ;;x&A=rO8Q!ZB`xnol;FKfuC?Ul2 zZ$YmUHTaM08vn9${O|Bj%+x6zYybZJbnDhFCB%dY6aQxZdO>c$#?p)}=dC!HXdtJJ zc(cU9fCg$R*ht=&L=;iIeEPU233utIEZoI!y+QJVB=xFGO5;-)pY?{cpI+W-_#7t9 zFY{Y43G$yZedTxMWyQqr=kFKe64DL%OG4p4%Wn~(f0 z;aIRCBU|R;#@%Ps7`N@Wi*bn`i*X5)82?T&5a{PEo7jX#CZ>cLd3<6md+vN0%$pn& zNy6uMxQ^(EX!%9_XW74M4iAF9bnK{O!wHW1Vyg8|qE{yp?C;0Nj~@w$i2oEybZ`*9 zzCI${8=t^1^m;8}0mgXV{=q5n1bQ_QAtACb`9yp~FtN#B?0xkKA$WU*f%uU3=6St;*TMTeUl*n&X6w3_q=>U z>h+iSxj6sy@-;uV{ok-SWGY3Ukt68WrKxNp@pEy0(}Ec#8+B&*h!Hd_mrY9Or*TZn zpIZL;#%Vn3h74fp;w5Zazm^db=i>KOC!33H5+{ycNm+w!-D@%DvgAZk;w3FhwZQK$ z_(19$^MX^ijqXV$V&C86!ehxT=(i!!=OLHw|F-lW?;1&+mc!VwbrXF%G+_H(Nd$Y+ zFk4CHuHMA@HLKZt)B~T#yJ%9gJ8oOIGI!Q6diC9eBo|{n_mewA2Bx1kibKhVf5kKz z>9OgdycYe|gF(Ifv)av#`P0TQdF6gN{N>)Uq)Sr(**mHr=)ndCPdmoz1LJAkeJb0w zZe-N39?V~9ygsR-o^kr_56|hfTOTr|F3Y2+-y?Qn8C$&y6P9gbi`xR)HW|o0zhCfy zo8-lzLw8eFeo88f7*3wNnX;y5L&usdy7gyo7!|kA-p4HA1!wPlYWT!6IDZBTbXu9R z4(oeVAbq9o^0=5s=kJQM`WD19aoB8{%-Kl2Q~{!aAcZM#4t>Ds2O)9{RqzYkHmqUo z%JG!QU4bR*HnM*GenS5R`cvxJ)<`$8P6+TM1Fq=|_;^{;^{gcaUMUGmRgvTsZ5F%FKom z6|0fO(OecHXYY8Cqi}VK=W)dU%?B*RZf{>}sZuSQh<{m*U#fa7GWqSN#_A-luIP?F zE|6;v-jcgmd9u1#6Zi2hm!E}GpnN^@r89nI@q2QPr=jL#aLPdba)puR|9W=&JYHe8 z)NWb@dtEfI-o#R%P&Ul8QM`GVM2^fBM2bf`?9oeZonOQDcX^pTpdrO-RwAt~fRpF% zV6VG?IPeE8ugmA9c=G;O*vel*urNd%;)aa*+tVvxI?L(s5{` z(Kdg3w~Fk{Kbs>h{HW4-2L&?}XYZ*c+*{F;v8P^&?J&#wpQe zv@VAANDmsm8p)*dI&2)vvEOYVLAMq%d~a697e2*7`+3amB;_-TAyul7X4Yk zDjipsc9heBI7T(-K(tE&cJ)`YvP&T%{XUW;nh7r-y&-e)S`^A|Bd*JP3^ppBKMA5_ z-P&ZZiJ^a~h75anlL8`@z{?w{JnA?PpPWYX+MPQe62v*%QloJV63)%0WUo7{-adg6 zB}$_CaEUizLTp*3rC#ka@&NrR{SR<`-#n3$frT~l5i{)tbEg<7f^i+Bu$P?sDoZ`@qssrG&!k~H!bnvaNd`nk*{?f zQb)bvn7b!gidLm`ZfX7iJ-0nB5gxB4XYm>o&TNAr@-@dj-ikQYL>y<5-yNb-?d43| zw}LxUx)WY&96c(RrF^>EG}vOt=C-#CX)qyzPuRzezy z^77_!yrV6!uuez4TBT7(`QjUqOu%bTwCQqCt6Xj_A3Kj_)?!pCWpsw{ElgHyt<6|= z$cBS@9i<)NU4Vk&ZIj6CW5uEn9oy?@c<*V&G;ck->uWf3)rP0()FeN%qFQYgPlaGl zHki>mr=CUc%&4z3$HP(0q@sG#nHzZLYr&-FW=trr<@#eQo;s^>E2AS(`|EX~$zTLd?(S5rTJ<;C%>GkczI<7>b2nk)TO-+!|06x+ zX2$1l@3uSi-DsSMOTx}Ejrcc;v0ZD^a8Dxri?~uX#Dkr_&{gO^Go=E>=e(MU2CTU} zGwjikt=Q|>nd;WBiMG!`m%?UDT)c}yB?@t3@)#!WSj@(*4e>17mu_{+vU}WUPTI7i zs)!$Dn}M!XYm)wECte!5Q%Iq~ee)z%y3XXtU_1JbTS}!`rC8EsKL^k6K!0&D-4@)Z zb^B6`8oZiy3BF`Fwu~+B%_*u5V3=ntZvCJ~hx2$mTZwh(WqS2^!iHH6H0pbo88e#` z6q$e~F^sqGd~q$2gL#V=<5;XLH`h+b-*zz_3V)d|SfR8aHt;=abqOxr3ZzjjX9!|GAniOqP6=DkMp;mCZ^bVz1W+vyCtHHsPCM^ms#a{{hDCOLZu z<2OVwa!5-u2EAd@u#x0%(1^{0doykCVeAeKWbTtZv@T-HEC0(B?pch!eMeHLQDYIO zCsTGGp+I~L$?9Zr{x1nn)Ds)*!<*OXs9L2SP8WOeZhmWAKb@~85xvN_Wc2juYTw#E zpTl8}6pVe(Fs~Rk4sVFJrzk@USHf?&anffVL!DPsd2%o-CN<&Wns&^|*p436vT$`x zUtZ4HL;terQd0YiF(As+K>PA4hUPF3`reAx=Pj9^57Ih_jpF}^cr(&F8+)}gIE!~@ zq8UxH8MygDLBULVG!aVf1Su$#UPps0D&F6=r13%MS58d{twLNG1Fu6A*k#brDZRLc z{|;^a9U^(7GhyO)B8iXhz32IpNsS2;|7~>mCs~j|(%?TJ6$kEy(z~$qTgl*|rP#Ln zp1ehR3ICw+Al8NU`Cyt_J zvnt}n9EegILRk^NYt=#`g|xJ2Y{MD%a3KP-)4NksoGs0`yL&BJ8qH#G-*I%w7|FR8 z0UTJom(CmZGqCp<8kTSsf-8yDGxwmdv_&bz!R<|}@kwyR!OqI~k`j#u8(Ya`loe&0 zb)b8fuJmnQm133KF>p`^Y~CK@@Fjn2^g8s(ui3G~L)z;z=9boY-#*2V=0#Z<)`(>t zr2Hm|W94V`vUw)Y0-!!S#6-(xM9p2GmL!AI*}?lS+W9v zgaq`q)}MRXC2Z5WpbnGluJt5nT$sFjDl2>U!C!6tWsjcS8+?l5JEV*zy zLJq%wazA-W)qt#Jv3`4!2gzVz?nt99{pr?!5aq3PGcJ^86HlioP<}D)2yURQh zSJdJMZ+8XR9bAZs)lr~sSJEmY!O@yG=iSLvr5gEiS7X$mZj{XKNZqFGQK+M^aJJyV zvD0E-GX@MS#HQ`fjY<88D_d9L+GZg`2Tr1$lRp*|&Z$j;RVz zxqt)lDh=9jPab-T^c6ZG=A39;Tgj!nk|~f9tty`EwT4q6VJfR`=b&Y&%p_@~cZ~u^ zXB*D1oQE?mDTa3MO4E|A)a^W6i1xbTm>FnL+l(vs zqNUUP1p-+y`;dHpnWr(}v34~9BD8T!k)Pyf%$*h7J8_XDLpmCE=tGB2T^QY=A?dS~ zr%U%<3}~F4tM0FiNqr-v!JCO1anEVZ2oNm^X+~(t)LZtnB9@FUdVB(<8bHB)e>2hu zpPL`^=nF&N}QxTCGb6F`h?94qI`& zA3Q)Neh&(1!a7?kX*BMaMPaf5GVv=&g4~1&6aO&sbEu?7ZY7tm1RBG>!rImz^Azou zsqG+K&g_HGuL*L-4Klyb7Wsmwl?wrc4=l*TPLIG zUwonv#6l>`zav9QU9ck6%a@_+R5!LxtS^UuLh6k!(PlIo&Riwq{Y4!2mO_OHv9Kmn zdRtPZPK$%Jke5~G4Rc}0Q?mXxAEJE4QnOBdUR;uF)GfsI6(U{SnuB`HXTa>6r~0&mjHwD^+SH)ygcBrb4LGGXwqBi6I}j5riERxU zt??O1NLI_PPCrpg+>g(%+)i2hIbujKPeskzwJBYrCl_w+A^nFFiql{nfPub-t;TAaV3-jb?_tS+K~`_zj5r>$5R414Qna1@#^s}Sbm z@{&1|mbR(P=ycSICpKD!uK44h)$hAe9{kX-4bJB(He9_ z28aFZ==sE$Xf%KNHZ%|y6-oTp-VhSwh>lG{uSp;*@)rg={RPB_1rrkeGxmUb72zRK zQeF6&_^@#KW%0j|%H+%I;@8n@lL-m%m#>YFzkiBH04=dGf5kZ)hzSkB&rhW7<3m{d zS7T7L(c+jN2@Lx^jOL^FN1~Fx+}yE#Uc7qrksp^}Vsz{edocy^ z@xN|&`QOA?R$W)k=I+>TT=e`%Xplc=&YmVdCWg7g+j8#n7|Rl5N_CGLki&qtg>grEIfuVRSfE+WQ^vX z(d;{amqufEuwiI1?mY98kCHK8abDj$Bj4Lf@rKdp%qUy03?7Ge6P@70?t6ZeC{v6k z)oj_d;|Xzox4HfDEn1tjR4tsu1W9nP|Jw>0BytY`oj@A2ltr;=6t zO;$;hx=3DRTp86f3!_GFA~-sd_xDb)_+l*M`;;X?q@$8Y)IrO+tB5^%ke7Nh6nZV8 z{vXA&7|zY(OPP0A$=tE^^o+*9z>=t6DVevK(xw0 zh4NLf(L@j+%0!ViBl>`QJPAx9F+3a#mkg9HR1jU5CxI%-;6Y$jf;6_bcrAXKX;cLH zd>~4cQ($NU<(ih`(*E5|@;+G|wq$HAsGEP;c1D#5w6)%otk`hE+Eq!T-*HfWMd5$k$ zf`5ECm(E?}ZBPsvd6G2IXed_^FVT<-*Tu5y%zesN&dZZ)$H>%h8W+~I=lb18WGht_ zuj@PIIJ-~Zqg2&`Vo$X=rns-gudLZ@xP9#wk)cuYdFLuzj3+mxuLLQG_f=A2(pU9Q z0V?K+=DBYo*|TLP;JK$bw^%IFWu;_+{Ak185R|MH?;3FoQI--qwd(V4X+pSU_1ABL zzY;T&)CSsBPv&^jWY*SKv8SdQOHuZ@bE+Ah-)QTt5-pxql~n9(DB@JrU@o$jXs%~X zLlrqhn=w(TXK8&ksYEu*7f|EYNX3Rm$uvuCkn8i(g;g97ad$URQ9hMHyt7k!0ZjZZ zq>fHy+S0A2Cm0IiAE_rWT7g%nf|5CPq_H>1eke`+d8C52wzmGoS-4)kdL@gd1`Qgd zgh2SI$)syEjSl_#l3MI`bIn-x2d3lI+#z_EXhV_IUwT*mZY0-g*|X;8(EN)+nUYkPc&?GzV_aZ2q z_ZtjQjeA7P_M=Hxsxo0uu8}Hteymc?FY3`o(&Vj1fu7ST>?DQUBZqxnk}7tmMxI}D zOPI{eM)k33D$2w-ht1FO?D8RWISLYVY$6>->?1P5o9nkualj*y7F7~y(_|fuy496u zo&4i?(Kcr_9;r0Eet4T5M~{%UNMmxEJ!9~&QQUjs$*nVo`Jl~3*#dG`C=)8%GB2bG zJ*yc9F?~W6aEpG^SMl`OHMZ}+LgAYANfW%CrlaRg$>3*V(pp5o5;h zqDh~2l4&e&Zyv#I@fhZvQPZVKNn?V4Gm?3fTCL`{*pN$gz|EUC$(1V?S+ZnF3H>Qj zouSoge=$ud{N>A+6fa&JrDGAA*GR>_t-HB)>kcuBT-2^okjFPKk*Q2mavJAh!Y1%0 zhdySed7DlY*4$>p&SN}FD9XlV{g4bU!mb@>{occP=`u5YLJu?x;eB8N_7hys~zKNj5pw2XJ*pMg3*Ky?JCBo7br&^&hl*|#wCb#qC zs#TvN*~mE z^Wc{I4Xmp5Wz{h0t3fJ?We8`}mV@{tSWvcjMJiUVNq(1)xb3=(OOj)r(^TcFuw~AAGmX0gR_-9uEGph>=D3zCgq?jx{P!#*s7_akSg6Qf zsS>F_S587SCR$Osb~#jWNmOmsn|#SvL^)sKS)`JBl}qBBF*k*CrN%OKehOH=XT_$& zI92S&*p?-T_qxmajk~$=A(3e-=94>PPV!s4ljAs7>d%ChMZ__*LXcZfv|>^6l`g@Z z(|fpfJBkW*N@C@Z3Ey1{@U7I7Vsh0i<;O}K%|*$vLZ#1`g-(n6H_q(q!t1)(uA#bjx=tK)!Lh5K5T30O! zNiPcNw-v65U+4Ev3}j$t=Uzl9%*oz<1j8E^z0|n8$NPUiGYeewrxmYB4)3tpq-bJ?I+|BtUhQ^aIoddz1_jvd& zoWd1qkUg~--XHvl3<@Gk=_=UxUF5=*P_%iA(7r}dIsJFH-FX|MqqW;9GIZv02|ZoZR6Czg>a?mVrV96)K~#Okw45nDfVXY*t(r|!a}7Wu?| z-j<8$MqsyZBH6ZFrE?}2Ual%{zE@m!o0GD|goNMO*{sy|VNsKxb{6dEQ;(p|`xsSC@**M;O`k%I==|~~DRb3+ z6Lg-(7<|={b^U9mg#2}UJUx?D+TJW_CLZ|jj1Q+~u+h+m1x>zf-oDLDo!=)WFDpMq z^0Hzw_xTPngk9$*t}I*ClQX-FcArXxaWWpsTY!TymW{nTaw$AB*)88PwC70X4(Y-H zFCnOoj39rTg<_9z`gR;o&|fUZe~i+?lA!nRh>i@$|Nb7LUCLn>dxq}4jlN|4PA;R* zs@vG7a^!)>2_Aa-uzK7m_CEK;Ufk3UiU3A5A4p(~C(YZ=;iKoSf4jK?!fkLK+$hR?ZxR`rs4H9K(eo;R^6p81nK5%G9GgJ!Mdo!<*4EgaAL5BF$LrxRBn2a9vsO_zQfu+5Vb zze5Wcw&fWQ+-5Rr<2Aw`US|HBlf->IE61_RZHzNw`van)B1sAj;`z(BB#8!DK-ibb zKXhs}1=^1x-JK1xf8Ax5tQgp~6y|0c?yeiiyln??KXH&|T^Goo{)T0s_zBrL6s zb|x0qwpd%5%b$FU3E|wmTVEFT&dtdqm&CpnqEb;{Wn+cX+z$JU34Dx>qhz~UWRnJ5 zncLECKyL=k9!|{dXQ(5Nv(Uqfkg#WX#+q~g>@q%vnUkhaamJ78M&Wcn_XR>vQj#T| zMm6I6w$q$Fai7NRs$&qMSfRAU$;pnR+YeD?@KS~k7|Zr~%gAPDz&T%WMh|I&jpr>a zTTGx~t%{79(VK^7ccXN+L9K`*)Y^i2?W*E+^&AduCelEPGrbpgPaL95od%Su*?>w_ z+EFrZUfS3C@~Inx2DN!1N*7gd^1@jXvKOX=iv=1Xr0pED;9y8Y`gHb$9zBU9fvp{! zY1e-swM&#3B@j#(>@;;;AOxo0SG?>BJjLprLIEJBxN#jp_N{`|ro z7A;!H+)d|czhpa^?PBH8_2%YQqA`?%R8FaIiFwc6C*B<1b%a{OmNR_dcy`ZUM*QXN z?Dh@j~7cy_w3_{C}WK8Q4s8lMs5%EJJSbpF!eiz-i z_$r8HE2YNOkBEK3&^B#I)ps@xi)2QnPO)7T7z|QlG-U;~xS~J&ys6QCiTh6=HI#qP z@>lUayB#gpY8(T*)|Q^)pT#0eX-1A7!`MMR$^0wkS0;W+&T=&2w#*0LNGHXh?_^=3S3Gl9z$?oo2qW4aHT$LRJY z1|(Yf?67Ckt^#>P3g>O2$oT?MFL`5?;| zjn~= zWQ$$QA=-Anz}Uh0*brWilas28IL9bG<}t?xIWqKoCXUSQK$q%enSTBrxl=l|0xm6L z@R@vUZWl(U*#~JgcsKc9Oyp+z_FP#!hS^UZP?ltBWT?x^;A^;dDNEW(_h_F#iP2@N zP<8cUR*hWAz8i-bmah;6*KMa$4riWTyHD}19XZ&wEQOcfBm3E2tc@DX%AsG~1M%mn z*W^0G+K00~p))5&R_4iyzAUmCM6qQFSDy*`U<2A{&#c4c_o>JSUtW(U)&mMKfallN#Wo1(v@sp~M- zzq`bzKC6i58|XMAf%At(riA>xNR1HbE5UCO$kM0IRjXD}vu4ddWwIhoezk7hI@*Xv zjC6bxCQST$k;aysIB|jj0|tR0qH7Q?7+(#mnhnACFP@5GW}36 z`J~AdGBsrGU{{898byHy?M0l66zQ{q)>bG3F@_qg#?igz zrvaIsbSXcP1-B2A>Fa7D){~KA#*<{75oLTlh1<=>(S0ak4Yx6@vT?xbojLVcVm*z6 zqbkVjdxn*!=Q$U~w=G3TNGP=iE~j;tv()Q*n#$=Md7H5;JEnC>`N;X2&gCYv`0ioZ zhFl`@)pq(XO5niOfhi$>FOiXvczSwbZvMZ!D5Z-0)TvWcuU`F63-UX6?)W$I+|Bc7>d_E;)|KBn4?xrCfiV*rqjZQ;Q5( z+E|L{$!L_;qMSt9A;D;^ZLzhm5)ZzW>_gei%1-tvEtQFdC=-Ra{xR`dob0Vgj*B8X zQH_1tbl6MZ0d>iQM5#!V$_A}Yl)dHGO%=&YfL2adC-w_V*5T-2k5W9(R^kAX`@ygn zaoyx{5YY`PA(Ep|*xHlU(dcW~h(UHoW^HHtQ)@s&BB7zN@&L}%jyB>Pl7tQm8C4~nEG%t> z=#a`=VWuY`E(t5~0+)KSl?tU%K#F&m`}{%dvF*r?VKvZ+la)Gsq(O}8qy+hbNmE4I zhypNAF*-76g|L&9l)%E;fmcUH(tCq}t;@R+@c1ONm%qU6?mluGv?!HE!KSnjVn>Kv zOS=y=&en~wS3M}5T7#LTtq?&%h-g%@e_Mq#>4M0!LF77Fh+4_6_s{bCOjf>sz82)) zD_;b;2@~HINszyL_wIiRa;Y-^D+Rd;6DCZU`1|;_g8bkg8`LRzX^6VNlhca&Ozz&8 zG9}B>YyNy{XK^BPp<+aqKV#4p~IBgO*KGrm}g}LI(8e%*Ly} zSXo+-DtiIyl+1@J<}ouTE@1Qgi3}Jpn9JT8v0aFIvqZKn9?yWmLzysg1haSCLiv?X zZ)w)Bbh!&rsX_(X_Ucbg?%?rUPsFoBEOPU}!O@YRM+aH#b`2W~D-mBI3RQ@FYfH{= znoJLo$5n?PVeRBV#Do2G>obtPgC=vwFBS_C*TfHzY-N8-Z{R=4_dMXugb5QSOqeiX z;uDfR$sg+>7h>DscbSrn$I*W9Xu7s-MpkEA98x7PszfC+EPurC3^%FTb3U`y9wJBN zQEE3`#i{tqjIqc;(e)RZRL+MQ?GLm6?g8%gE5+Gjn{eykNA~R9SbX&*MS?fbX@ePe z&d=uF($0*3QeIk>WG7*S6TQnklg_FlP( z`eYvlpUBPqV`I6oxi2G5<>%q?Ce+E&j)}MK;B;mf!`w6DHn$byI<}_ws$FdD--9L_ zE>SY!6=9Cf6v>oPl*6CvCI4SN)C@pvj7axw!=qey@4& z<;9Uhd+~6OX8D8N+-lR9G)o>(_I^*McsAhb%Jvw-o>8IZ7}h-7$;`Yh7=Gy{HFJAW zKXW_A-n~QMl&YL7vW9gny(nG#7}uWe!z^eom1+pF{(3b-s#K!pwhwg7r^ENiWa=JF z%foH`KMV5r=cd!F-wCSJ$i(xH4lLiZg<84oxwmH&W6$N{#{QAq+B#VL&d03-^@SjB z&y3sdobQ>Bm*tl;yk07H4{MA4&@;rW>w;gE(Tr+YmcqGn3N@`37a`@O{~*7`WaZkm zYb;u{h`6{f)8&7UNMctSOjfK|G5PoRD#)eT5Gz%xWD?{iz9~}WED7=7Vnc2cY#926l7qQu0c3=-46u$o8x1daG?O#_jF=N!TGdJ13U@8tV zH5>A)SFcjFYE`+1{CnlnrAySVT{~sXgo$s5$%fp72@@v%`+QqLe&CPUkeeyZN%FqW z{)?~B7<9x(`SJ9*ib|!jkesBJdnGd$C_&&I52DO13GjSOU`T@O2wtnvij$I3F{J!9 zpx0^9>I~wyUhFHxue4qIt=6EmPD|mews>5BghG+PjhoMq-0gjhL9auVoGA8nV9K(k zMDFa%{Nuj3WXMcHbO0(eJidN|SToseggCC6WHT%3R4I>*b8ZHXoxq?rjYzNb=Y=Xe z6UNVCOskUk_=lQok$(pHn*B*Lo^OqmM-wJYm@r|&go*DRNwWMwwP}XAt%1XH`_iRL z7us|jj7{eijH;6phitiVRwR<8>JY}&iKbPPW-Q(Q3@aB0^adq43b`9bJj#saSifpII|g>fKYu$~I6kLN-EIV?DNd2>k{@IRImK}m$;nh0wt-r@ zLo}$@fTlxNqq8>S%#!ictyh<0k!2X&xjc!U>9s}LRyLMs#cwkUE0lT> zt`lKaN>s^e=>YO?slz4N9vsiomPiZ{_JcJ@y+DC{S~ud z{UMVTue0=7|A0jcrr<0tgXe`^ymhIJ?VTgowH`+K4F8I#9^*4O6vr&>@ zV@9X0^Ql@OWlGAg@V~oU>V~m(dZQ zsKMU$i=XzOhliQF>H_92cIZ?|WGPXDQN7##;xy+!Mx7Xs!p2_qi~fngcUM`u?kLd~ zsTn4Ssy3s0w&v!ZS?ss$Ht3&gbnKf-5 zK_z-HwPkK0+P~O!>$U37Vq8L}R*B;XF|Cu*NRp?PPEJY`VqA*z>A2#jK{9ob@~)EO zNbyxtUgY@6e~B3Xqnz2eixc}#bJNr4btT}zRql9(@c6_LUPsG8s3QaL4@oet{6joB zv>vA#BbYgT8Z-OXVd~)C1pZ91g?nD*>Vv?PH6yq8@8fx_6HU9eApK8thmM;E_7P}o zC;kZ%xVn2MbM{|IS&wDIo<;22=Ye(B(zLEyC?#C*imL1dy5!_=fBZueQ`WvB`XxJ$ zKK>12T(pgYuFvgj!quUv#+kV|HBhRXK2VQDW5Z@Vt02l)6V!( zsnt;C&m4~S_I-->n8ftagUIpK{QVCPY$9umnarC#of$J{(YtjClKmfZ{M;*f`)AOt z;G_&;!Qkn#2--7tH0_$Tq)qD;LXKNvZ)48U6|-nsqZYG{JeAXXv28gsC$3=bgrS^% zEM#NybGo+c%7D(jIr}b3j`KtGWGqmVN)c~(q7$dcYqNqZd zKCmfu8`fs{$}Pl3J*Rv7?hNcUfUB=wvAkSiY2}m#?sT#S{)-xXg@g;y5WtKJcA0W|wEabau{6<#e$m znVEBZS_gU$8qCy{mwA443VnMmVCk&E^q+Q4-tX4tsWfiZh6xMy;+QHGv9TBFKg3Pm z=6!TA!?ryU=Mu!!{!OXZpbldw8a z514!W9<1#g*fnDi+)4dNFx-KD)br7EKjs1+8=wQ4;;!v9DNwmwx%57&DoBa)A zRveYhD9jZaKEC%y>35!?C*IL#*)j&!&rFmMODeUByv-(Y;@o0REZZ(pyH5AT_vtic z7!!sxVeyE*1SRUZ?-|3)9h+(3nqsr?1N1`dx-hbb1DlTo^Yr3TO15i>g+YTRE(E`D z6=&yRl}*KT_k$nvYkuFlzjG zMhqRmcFWH6EMdXB*DuN0S~NI@W@X5XC(Jp%ilwVoqPx40yRXhNe0?~Fjvr)R@ABxR zDTk9I@%k7lr>Tw%Bq%}8xjAEqsx*P~XD?DcJLIj=mFg{fGrDGGIi7^2jXhW0rZ9fO zScdoQ!?Nf0EE`gaeUqnR(|b8nr_W+m!)O+5J-_W3wQ(gD zjqRC|nn3A9uH0!*hd-iSi)nP+FqO2r1av7jEe2^KF5Q>U3(1lln!L$?Mq&B6r{BUt zhwiH(8&)=UT-iM7b3RwUab|Yk@+n)j=nV$h%hQihD3!c_bPW%W>tb=|b#SsQ(qHXc z!*PENHWr^;iyBSUzP1W66YKx=`o)9^6DCZ2Ur6tvZzsr2{9!KaI*6rJAk!D^C!=FL z8_z^zX>AlPW(ozG*eGJ1^QG9iT9e;JO|dRR3EH-RjWLZl(pJNyRfi~9;gfjzcBqq+ zsMTdO6UU7f`Q6OI&c#t^RI(=?33GEL=0cF^v|0)jH`>hRE0q%~O`;G!@)==nrX@CO zJ>1uH!F}^8wjSQcySM~wY#k|5Jo)g_8mEdhziq|1?+ zw7+;K3(+SUaYZ_fMR9mETdrrNea&pB)jGMS*ve9gw|^|fOBn6T>(^>cHb(_%vSq=-(rm^y24)Op*5cV*y8RsgpjfgO%4>|1GauIR0irRXL!06Q zT{7YNtU3jHjhghu>oab`M8-~-#^DW9kcJzZSy_`WhbXt`5aLtkC#xLWo+4TFc-?vk zg(`@vEy!3vBqtJ-9$=+~97`JeU@6MlDqly1c;`RWXko``AEdPI7FX8 z^J%g2GJOl!Vi0-J#u?3R^x_(s+1bm#KO<+!f>ahsBz!XSNwCKLt7sZ^G9?=Hkn=fe zPz5=k>1A8*Uq_=-(R$<~fF;Nbq* z9G)^3zc>|Yjh3X?7<6g!P|5rbTipW*dwGWa&(c%1N1b zOk7kHDk0R9lC;FVz0A^cAL!V<7pWs2;u)Ytofs$XN0FdbLtJzW78#q+p-@^%Hg8X> z2BooAX2;P^M@($|uk>mP!4(@#GMOo)JI(zJ<%OtCBsw-p2tE~2F^SY`RGw2C7I6Rh zHTqBN&+}jvNeMQ8M0k&QBTL zb#~qeCgj-(j=af2-QIo3{dyZmZ#-e=#_dGMCt;r^FBV~!dGPo#8~2?-rP0%{Q8|vU zo6o(cSLrLx4$_gh|VI-dP=0VxK_N1VhFAraOk-c7L zqMokh(Gzd>AG%5THqroFBdUZrjLwVf89ycq3uf)*-Mht&>(_Yr#!r-u7QNgRu3+KD8Mrm7 zj=Q+Gnzby+s_Aoh{NyRSmM=kFsv4h$9h)#=!h{JEe+xpyC~GutF}-uuJmkxurf_CG zg|q0%l~#|X+`;*yZZH#n2+3IA+S(dROUsmyA0kaf@9XPJg9Z&q5P~~b&4v`plG?b@ zE(cj$G~_E&nY?*i$(J{~5I?18)1(-;cJAW3uZmU!##1tj9XU$mr$X8CWKUOsa(VJn zwR&-^zri;UZ*On1XU`^23}l}!6S)c&CWGUb1DRQ8rfP8u4qtmu?G{}rTRb26a%acY z)|w}G+)3MP7(L3nVxKl0c?uUMXO@fus7%drGYMmE9D#-0pWbCXA0$2?i> zc^PO%g`&nhDlHtym@TKco>IT`7o5^$5P2+!i?tn%>J;GGuKnEb*U)~@Sc+syOQU*O zICt(QIcj#MX1O91aV<)v!Uhgr^P*wvZj>mLhZ2?RlT-JevsYizxczX-6f8nUMIgTV zEELV*A|J=fAvIZZ<|TUuV|R4kk`*u$dc8`^j@Z3F&3TX4P@*m4T9>9&i~9JT+=0i7 z2ugJxN2|gvWY3+IM=t`YP@xb~|GX|T66?&lvDJj|=Cvmw2?okms6wp*<{aDPfmOL? zjBfSClZ`{V%;LHiA-x@BDA54xR~K-<6-keo6DgePi-#U-hcsl#nU8E4jCNOfOP0ez zZ;5Mm>De$NRmM!@FOr{B#*YM_NtGoBpdN`6f5zU&R-*i0@q0tcJ|DPaT$Hc_M@3QVQ@&6mCKKd5DwNY>~uQ(9nS zWr0?mj9UB82w_R|NR55zt4PU`Uj{0hF!4Pgz4!9x&rj;qsZEW=Z@{+} z(o0^G;$!=J#Z(!Y_`CQXd!nRg)XvEXb4$zL`78)AP7>RfPNZw6&P>~M6{U?d2f`;C z)s$!gf9B+c1uPgN87m*I*7k4aLUV z8fC;Y`t%#fZGSbE=AT|&zrVrqS77?`X5xFqbYK395w8)GAU9#cgo!`H&xz81ny>Qo z`*J7Eo@!6ij^(*~=pMCdmq)2HU}0%43uuMXT<(FF#*Zi@K`nkuy~fhSRPwr5lu8A9 zWg6cd+TmeYv4wCd9kBg*nPE37Gg<5;^I%hFw>_nmgbRk;MJeH~BQrtqBt* z{z61GW)kGzE4o%T#|+T)1iX7oVAPjMgpz`# zvWi3Za8_`f)ABMhNOemUQdSgXjo$&e_D=;R6{ob~sJyHDu_b(^%Np66<-1j?F65tW!%` zHyuNe(iWvugk~0)sUNUrr$2M%3?gT`bfhmM7*a-)@s~|kv6_$V&|oNd78c^kT9{+ek1Wr zsa1p8O`B4yNe`|DNOio5%~N~OuznL7Hm=R#r^c9vr?#d0;#DWN|l?AdmTr)flB%DVf4*3=okm(UNlIdb;THlR%W+Yq(z_xHKggb){d#^PF_ z2G667>$f&cWa+U-Z0^yXLm$2eMQ#)!M+Vhn=<<`?@bKWw(M5C_wdZF=`OBk|n6TQTas^j_K z6Oj`B*An;sGTYC+7QX`MU#p|>1si&e2JO3W)8|j0)Q?DHR>PVsKXMBXcX!Tjn@_8e zOH;P}Zw&DtShf9(_!Ud{V)>{(X}@uUxJHv&6{cj&(n5oC)sLMN)$F)v>KE1XtENz8r{`N$P67E^54*M_O z#^c&WHjN(3j_a`^h8JB+ittOfaQC>zk@*7{vgx96=iflgoAd0vEQxpxQwMcp&8aKw z+BA|;%cPfkC|!s2l6!prjgnjv;}H=N`1tq`6cqH8C>QSpgARj1kL&?A_zX+;B(U}5 zSxzqQgN^nTbLL-T-rloZ+Ow2A&U$>_yd_p{JR1mjD;n5(4gT-^c>DSh>FQ46qQ_oB zHZ9__3$I{to>a^n@>G@>h-MzcA6`V{-t&B8L~BQ^F2z&OQmXhJg#m&5VtrN8#*xHK*hWP8{zMawi z2QX~iX@c&ZW6!QFOdPRM2>dA4P8!G1A=7y!3*BfoE}6#gp#zwA{H3TmpEADhKqk%F zDyO%7@n#-~#_ffJd)T;dIWyK={wyx_{#R)?_8{x8o#E7(s|>7^Q-p@IYT{Ui4V}R& zxiz8V(%OZLnJ}D(qH=c>AwJi3Fsgq)RvvvKMfl9QsZ($qw3?GA&v1F=NUY6t;xbud zV+B#qjxciIPzLlK$=!%}?z?Sa{nnKX8#j}W;yAW;wm3K$xc61~2f2+N%Cd1|7(RR` z^EO=mO0gu6pw7?16DPR5rxPny9p~AGKI}HMD9#<-c_mx)!cJG&(jYf#@@@&ORPO-!=;=1 zc)WP^XCeIqbZ_X{WdnseW-j7gocI?E3REqY!bHSk6Ct1 z>ZI{w+Z{hFyn?}6+yi2f>h_IeM>BBvC{B2O0dTjWy>Y~s5@#fr0fmJM&ok<)kO5OeX;x3sjt!pa&;D@#$kJ!b3dc`RPF z1&=3z+&g>4*mDu}nv<8F$@@Gxa~!{K>_t(p)6#b2Y(|Y8%j_9Dv3a_h*TG?2y<+T| zi1&Vk$J<0~>>W_V`fy_RDt2F&raw0qb&eJ078W?Wq>`tP559eY^($9%;H)HoEU^FfMA$kW2N?U%)xIw|d*mD^PMji2YM1E3xpLtGM|bStMaa+fv+K#0x4h8BZ;T>N zluvltoRmuIgu>E})Ty0_3wSIV6nELXWf^-;-A}3T)tuS4mQ`yv@it0@I{XcnE?#7> z+c6GbIZk9sx7S?{QN|(O+`M#!)BD%5;n+1f{LaDoOq#cxIPo%ba&bZD`<6ys=Q4EZ zWxAHjikHVpZr-_v+uD^}d}{0g)(75Y%bW!)TDgUr&x5#e@+wkaurB-sr`#oR56>^1 z;>LxG+_{&s?=wm2E3tOT$msba7&~qpQ&zbVfAAy^q#c5cX)avp#?`0Bp5=%qN7y)b z8M9XH#9O=v{BG}H(xhoT@CzkhkqYR1-pDUVmdD%N zxOaRXhCHLOvQm5{68=3%w(pLPj`E;S7jcjNoUOUg<&e27UCNtL(=`VR&j(>?o|8^3 zOEIvd6Wv$1i?@iaY{H_H-zG}g?Wn>`AsQ+QQEz3SLYd4W+=8rW?NIr?;&DPDYLymZ z!_Jwkb`D>}ggCxg`iwY41&}O`E7}VJGpt4VzBsy-53yG4+P4$EIt;gs*F}=4=-6)z zCDW?@enD;~b;%2%_oM)$+qlX>woaMImCG5I5=|)>d6xTOTI_6X&}f3#xNrt@=gnvS z{CUioJ6ALl%}G#y|oKwr6UmbPVdaiZ|ysaQtm%=FT5Od6#77bQn#cQ7fq9_?QW9x2aUU z7Ij*5pmWD2l+06=Ze6R3qZ@g3&4VJ1CXhX41Z}Y@g*iF7KOu!XGPy%)26R|S!1H5l z_q1W|oKX~Ub`a;|%jCJ27&><{VOwT%-S{ZV6mQai8!N`JdebIu_$qKzSaWO7F+x;o zrcK>WlL<4ZVi&?I-$-un*@SnFwzPBAvirzWg6?18c~Fc9-^fQ1-Zrn6{l}hhZ|yXE zT$?auRCVrbI43`sMl47c_4(?}yIHX86jjPOvUguH3uiS+*`Ahim9z5h##IW{>rabP zdfZ=p-2-n=^|JZoUk^OPDdCzPPf^Wg%P#7l7_FrRsIX0vwxMUpi( z)EP9MxMQohdG-Q%8gwL|!i+Gl2i$z*$BV6FxM*LInPdBtN#n(qMQ%9N>`c$Cnw0ravPm?ZhB8vcDnbmR7vJdxO`n zUUKKa3_hl*&;PM^7VvQ!X&-*90rG(nVFfHnVFfHnVB4B28WrWhpWzs;~c{QPDnZoh}Ey$#o{Uce)7 zc^ky8BZmNl^nn;%@hA->tRiowCwD*K0OC68iMUetasl!^PT+ z$h*54zw9cXZfvC8z@-EPRpHX=F`NjMbGT14wtTiAcQz9S&0k9Bg9CIMyA%I{K}4Qh z&B7zEMclU-GV&1eq&qaI(+izX2~2P8q2>HbxM#{r#*Dt$V~yFDyHu{$kmR7DG|8WG zL(WX^!=QDyC>ZF=$UY;40FGy1>%N$j68E&M3sZ*-Wc{rE9C!;)xAdpZV5uCuW9W>X zoLN4E!Rv2QFqb&C_YiTcIc8cV*Ur4)!Grrk@a{q#RDdF)IncLNN}R1rJ29^JK%$eM z(6-|uvej)#Gry0t>@*FvTL9h}eeiL#K<}K5-q~NUQM8%f-8g`Mr8YQO%Lu!-=*ZozRbn zvy63%5Ax~eYI-kyDfVef<`4U5Gy61N{+Y;-!2>Um1`qcP_<1^`6Jk;MUHht9Sx;_X ze1TrP;G0&;!Le(i(e`mI4}Ch5&s&B@NMgNClhTlo$Xt#B;pccD1i3aLl(V;=bN|63 zu5CDoZ?)3muH2<*$7STG--?FbZ)nwX7VoaDrvIwf)NJ33OmFwlZq6mV{Q}77?SZXZ zZbnY*Xz={8W5`%sT6MrS_A^#q9zuNn*=q2|A$ebs1oY2l-4$XQ6Dwrm)Ff)<%!;qK{!t!oAxtljXl|0ddGW}*q8{JA~J?N=JgRxf~iiF#yBIK%CekMS&7 z9dpynIEw_wx`>ho=G zT2!WjuQUD`Ghl9_$I>PX^(uIhEoVlOLZc0xO=co#RyJ9wE5ftq^g;RgGr_l_sn?_| zuD<>_nSU=h^~fw8$eJyHqP2Q4s6l0s_i_JX{&;5H0@f}N@0?A0S+wy|YUnqPO=?A0 z{{A${W`kNQ3YGL(NUt&63q!F|DMgTIU`oG50%cM;7F*Qf&)4_z_n1iI8@_X2tX7G~ zLG0&WqAtCA_7r8H8{K>KqE)R@BCcd)P6erzHI8Z9kJ6w)d6Grr#nj9kTMIR(4t=0? zw}!ZRXA^l^h>V#EQ>Bn-;Kse?sdps`x;s#_f(VljNCGV&Khyupk;xsQSjorBo7f~onYBe~MIoadEUt zHKyiPqER43sHj}4H|t7J-aM4f=*){Jk6C<4!-RpIsaT~mhb9cbREWI-l`2s}RE8bf zwc_fTW4u_m5Z|_g$!?<|sAd=HlqyJW<^0n{|i{eG-LvEOqr$c!kybIK)re7E(Th`;_2W>VxkH4`nTos>J98W@{T6;g2cT`$tx#E zD-IpJOyj;|C{?5?YiFz=r>iM`LB(lMK0EOtA!Kgah0NY=H0sexG=2_~t7>Jezg%Yd z`Ri0@QHA$6Zj-%5SFw*fjeE8b`<%uvM7^}k8 z*~Z{TFMsuVgq}UbjwQh~?O6viA?m*NP=7llnK)BN97KpRHjLmCM>%zTD+3pwVC2}A zaP>64c3dfhhTv2F68HwW9 z?k#NJv6G!Ub{PJC67o)+6o;8>aT>NRBpT`g#Kb2GIi*7-#GHA~(s;(6;6-!{H!j~I zPHd4Ur+k*n>u1W*{nwE{I>Bq(@|Z;Ivj?vbXz`r&A<5jka38Bo+0ZDG zP#7ji(-RXN!rO0JkzAGQ5_WD1=U=KwO87|d(QD)gu;l208zkKq=eH_DU{OyZZ{G&R zBW^`SBl9Uh)e1$Kxp+Mr7A+&UM`~n(o0m@zCG#aHs0cyDbD&L9qLwG46oNAA$6y}H z^*nt39EDJ_8bvb6qHL&y;8hEes}agoBYE)p8ZH_N3eo5(=%eG@*%u^)+~=t@h&T0I zlF5n4K+2XYMuo!CR|*Sy^vKN6Zi|VGlM^2HkPF*ZbIE=%w~z1U@THfO3E9BI?<_tK zPH)S+7e$%cr-EVJP2OU5gxq*e)WbKJ7b|9{Ph!Hth>edne1SIe%S{ILMPi~}@y0a= zg@l5-y?qh;?tN>OSmdgV*Ne5Bcq1AIQ8!q9B9Y1^Gw|lt8MbWO#?GBP*|B{qM=sn& zC9XSOZbF@QMRCg8i`?$XBqpiQYSbia%qU+qfMa`4k`VoY`%iA8(nxtC@XSWWm&dsq zmB^WkiTHU-7bT5{GD^C?DpFZ9-o13kXO?b{WW$~{bni8WJ*x%?;jM@BSBgQak zKqq`fn8w5wWkRT7`-4Z1k-Q<8nCN-_;gcckk*M%;)6^Cn_H;QL(XN*3fGwncb*T-8ibG?mTOI^4i35>9u5W7{yK@CN(+} z!wW;gJXcfd#_gy6Dmx~2%PC$g8s2^WVi1L2?%u^SXJJhA3Y3PPCpC6HnJAwxCmWad zXG)7^NCr7(;>DX1o#azli@Ad<4sp+UCj}ADqxV|!bsT_xR!@%S?#k|d_H-DqnVMxw zkd&PK)3MTvOq2@r=Jxa&KY&4lMzdw}c(#oi2lk#g#lIwFNKrf?p=M;x6M*{7Jq(9y zAMsY{fvu$wLWZ=8G$|6X@~cbE$3xgBglC|)4!Kez%AU9vY8_d8oVb5C#T@DMg`<3q z(};VM^4-?S)q&5?UK)PKync?x&J&HJFC#}zW?I+6Ol;Yncx!h;zwYzu1zLxU=)_Cr zYhD>%&eBG4zOPbO9dn!cr{&bBnoE?o1hg6RP}h1dgKh-UG?xR3$!f8$$OVxXUj_N~ zt@C(WxE1~+VCIpF(Ifjac<5AC4ll;S=|>?;R_+@hB!;_S>MZS85 z-qBl#DUmjVJ%pSQEt?Qx)rkG`1{%)ek*@%sA6yn?QS1QQK9Y-ZoIfjkLm#^ z9V@YH$uQb<9mIwe<8ZOb#JFjr>Day#vsbL9te1@JO~$fr{$M%}9>eLoM<`(L!H`vB zn6YXZWgW${ps;1ct__qDEt{Oh>o9!E1Ul9(hFL%^G72#*sx|{!l>*0X)mXEAHGR5t zq5HrQLSS`d-+_f#i~1s2h&zSCksWugkT0V*>rTI*bq-Mn{Jfj`Pou%a&6G|&MZbZA zS+waW4!#AbC>pWS6EVE&V2akrkB!Wg?jxr#Zp>&#j~T=Gaib8Wo+5S1h=vOcoxPRJ zqD1AaUKvjzHw)J;iGyWkW{xh$yaA$4y#Ag%LFLKqYnO7)$@B5Jw}JlipRr``NL=(W zY#h^g0ZXzRq%c?ZAs>bn$V=c>`{ zn$Vj;;@(}0Go{6(1-Rc?&%lK*S+HX;0c9GI+w2NmXC9z>&9XST6=ZS0LQL-2g^9aE z@ci!MiideD^Ck_YSFb_DORf&Z1F6xf)@PrOK3iwX5PSj~8i1)~F)#2W-3oDVWEXs$-`izp#vP#~+cy)Kui$S8OOzx3t0D{wvv9 zFJ)?pI7Sa1$oOe12s5#xe50bNTTQ9hrWhYzeKlK&<7tG9j1KP^JE%9acif=hQM`a$C||oE z&Ys!HpTmoS-N%vr;Xe9}oW?Va4;AW{A*B@LV)2~%EbZ5q*b@EdTwb#MmpY`r)|y8C zYDjnPA3rgWG_WbH{Rm68nZI>npy)fB>AzjY#+e;cHfr8euih})*2_(}Z#}H{&nCn8 z4dlKgUR3Mj@Xe|q+@cN}XE$J3`y#xnyPN3^EvQwfBh!PAlh-jNnjgv8vu7z&rYz>> zX6)@QTf@5P=PpQqkX8DM3f1GhOlvK{&n|1e( zaI;5MV!EEBQ^5qfRu&@s^b(FXYfi}(`zYolrB2E4dd;b~Z6D6N1~6f-7BAm8;+>nb zdQuJc4X?+^@IaE{pA*<<7QhcBb+ zl%rUPMp~5)B;TX;(yu!`Q6V>wGlS16DY4RLC&`-g_hN#XxeTr0SQCTLlX^tI_L}@& zWYPd5>FpsQDr>0+^4E}hZBh?d5Cgvld+6?%({XPNp z|M6>aCVu`%l8X->KfLH@iFow|%d9>IZw$Xq%05HYPk;J%?2iNbAsF6nKE4g{`8qso5UH|@fkr3m0-rl`#5M)xC&OiK!jn%I`!lqc; z#;{`QLOv_Zh#wE-hvs1lFUc>MI z7Bgp`A1cNrel1Qr@3au(5;ENXUokF`vd{loj7!*O{9cSp$jI*#2&4)Jjxp z4QiG6`xg@9-}AlSb|b%yg0=cFecFWICB`KzJPR^(%yh;X#rS{3ST6tC{NWyQNsNcy z+QqVC+YA#PS$Uf;VxhBA#Qoy7sAS`yScR7y263roy|x=yjx)f#%FrF99dT8Fh` z7^B+Gr`6246!84axV|f>-lso#GTMo^ooMArHpt?yQmHcZzDu4)EG<%cqofWbX~1BL z+ba{S?NqEDG!jj@j#LcLa(e4QWJT)Jp;mrObS9V!!7aT&)gm3%c43U|x|G(_ClhmY z4(H7)Gq`>p8&f0y9ckJ_ zKL3xJteD6!*M>7`$apFbUqU%wGsD0q$?i{`^oFA+-s10($m5T8G-_9s*C)4g?Ufwg zJSC}CDkC=!9wQ_w5xv@s{8g&plYEdsOa+RSEkM$X59AYKD*oOHo+R0!4t+_S zeE^NCmB2y>d0FgpHXpl%xw#2yg&9G0>XFUC#4zwq66EVgO~$M3WNPQIA@S2G+Ks%* z+SOx;d2o!QcRpcZ<4DD7bqMebW3&+DEhbM!_T(6!9fK&D(~ZP;x7mB)F?us|yzFey zd*`QWK_7JD`mP_@iBq8(WOKFr&7%B23G&^$cM}{OOz+;kN&3!RQhG!Z9j{)!B2%VJ zh8KT&>>ZTS_~OM2vSrI=d|?_%bEIW$K+OB>8djb-!4leU6<#~%~qCNfJ@?~c=J!Bdva8z98F!eH-hVrqdl@g{vcE~n9$ zF%-?>hWyzv)?A0Kt;(@u!5qr=9)Wv8GFHykXu_VdWW#0p%xcZbo(rkccMyfMB{8-4 za$3!tPQ>=nY!3}!c-LASUp^h@`lDzPXu`Zn6Y#4&m{J+znK^JGWv8y8hL30zX!%Ky zd$tjRJf}7BuaD4W<_i`KE5Xv$!8GmN9rc6V?7Hv5v`M8H*JeJgW=!V&h9TU~)Qf>t zEtoQV9>qEjAhT5@5zn8p`*JLU$MwKl7s99!ducym7+x|Zzt!W}Z|Nbwc<~|&7cL}G zyg<`4QY&2QA(wiG((6MnrBSkTuUN4nDucT(BSz8&N&HG>%-BQz&q2B;>3RH&k$*O7 zwc04g(}*+`s3#n~ok*Q3L6{h(bCW76Q*_EtTzUju z+SkIx&V)1DSD?;Ti~JeQiFj~|4-SsIt>R|RK#JKo&Cj(vd&1USkJ0@>U` z$AjQ=B)ewCRri6d>yMDDPD`9Vo#dr`1)7z~idP0_&K@{~f8{bfI&y_Pl`E3?_#Bb0 zCCF`hgB>9*bZc4$dpj4hE$;7zFfN@M-#Ab0FbQn!#NDrr`L--vV*t*opJLh;uK z2?^oDhY!@KQNyrLdS0Ynq4)3K8+rx5UQ>Eoq%=yOl(T2g{;S)Ki*fl;izLkCayik_ z(FP&>pOE&Kdei;={qgaUCi3`oq&h?Ty7NZ_xpa&)=uq-#q85z>Yw=flCXD%G}WttHdwF=}dpJ2bWx9N#0HLS`BLPGSLZn?d~AeKKOih!G=3j2JQU z`;nyR9~9&oEL`(ZHAgI44_-oLVrl3tihBQ?PjPaCNH+BFn3|C*AOJhp%rtD-n#NVj zk{&^S`9y3?GI|`au~L#CS79o|{a3%WlBtJ5bQ{i@()zQ^;E(L{3!>Cw zTXGohLz4{taDPHNuTDl#mBzGe*@B9Byhun)#ydwYq8{BM!Ni)#*N=!c&x*gR)Ns&B zhor=>QDftm2dD67d`=WCO>Hdi-bUeTz>;|1X&;XK}|?+>B3M{li2vpmGo$76hlR z!@i-7soZ8hpI@G1_UenNp+6R#GM>mdX+FG93~k(#uM;cJ7*?Mt2fxpUAAyQ_O{!D2 zdR^+)twXJ9RakW?Bz4ZhK-G?m`S|P%bJt%<4gJx4 zqe~O0GB%WW(f(F^ zI!^V#AnMewPwkr3Y1FzqZ-0Yj+8;41F=E7s5hF&vVe-e_9vUz)#oSD0=*do57cVAB z<%_?P{i8u+eZP;iSu3_n_KebuZep9{_FJP?V9-COor?QUUXaNzJC@qFESh_YR-=32Efc~!Rn*DM%!MM-{K5;0iDA%{Ub1&Lkr~Wd zqGbs~eNm85O;w(*fDouK&COJ`wsf~qbyrnp= z)~My;IxR(c(j!ldLuF=%li2=z?_hcc=j8OFYBbE*iSjj0Vz4%Y1Io`;j=PqMJ! zVH%B9aCApsLtNpTJ5wdND)-kkHKh5M=TgMH=Gk*4{^I$2_VlT7P^S?iMvVN8k?L@% zPEM;qoqw>0JQX33r4hZ-%fqk;VI=*P?8kqS!r$+s5yD5TOD}MZVO@<%l`NS(B4 zh+$UL)G-7i({Qu5LH_X!E!)gB1ijxsleSCl;o$1R%S*c%KV~RxdXD3v5Z<;nwm6u6 zWLW*~eA3C8(rGATMvb9k-SNZo4F&f><$U+YfS;+&-KxLK)~+rKl5!&-7s664~?9o?$Ya?mU$59>qI z!7B|ZJw3f6;}@Lb?C#lg@4tv)4Vx1zP7``;Bn8_p5ql&tymdz=c40+aa@< zWH@%U2$u%entz)}%i0cG(dd=VbLOWw#eL|xUWDjb(zyw%_grGfv_1@7_JCIpE(j5Q zmOXdg;GMfXHRO-EBp2<_$HDjnwIqkD9q(^!qU*#H5P63_J=!pMWPiF(nMLTQYt*UM zl!+4-aO3WIhBWQOiK{o5-m^O!E=TkE++MN&NG9~`$He(pA^su#8+YWyHEEw7Y`gh| zGy4zn>U=PpH!kJg%NJ}u`A{@oZG^BiT#XRJTHJ+j)`Z`uW|byPnz&G$E11DeyKwT_ zO{R74#)eB#@Z}o)yLV;S(D9sj^c)v=OLny{$Jz%{Br&ur-;rnH*Ui-vXw$zh0|&Hb z>FG<{e)f`+`?v8q5iCU`^DFjF&Z788O8yc38g=5-^&3nP=h}EB2Gyf&^zJl~3pb97 z^8epeqehGvF=E8XU+hhyN2NETe1nek?B0cLox4&bvo)%eS%K07oe=8InM={UdOj3? z(qPU{CpYq5;f&5H1K~#(a7VN)EWdVho0?-CbDvQg;+eK;1pPkld3p)-R9)IjR!RqITt&|xUcc1-8S zhW#So2z@udp-Ss&G-y_fozuJXCeDO#tpn2*PNA&7)RX;7bR>)IeS2nM-OlISICg-N z&Fdr6s?aKv3_ZQ-q$o^%OE7W9G8#C4;KYq5^zXTpHcR%fcGY&;l+24FJ`$~W5R+&1 zWO${5tlNJc?$6+XU1RclY6#b4WBjCrY#mXaiG#;bx?V@>H0wkbnJaJa-{O|e8OyK> zLQDASbHQV2Crb(Ry0~g zUddH@woaRdd-K_>Te*?pEoxz|iYHWD+swJ+aJ#>oCqYB$*S`xZCf8=wie+3owVwOl z1?W4v2eqo^;{M(>ye=_~0+#EY?GPcf+{C`e}G$Ow;RUd}Ok)Eu)U6@8e zE+|xznUXlSSftNT-rgx`GcmCgLR~?$nH|2V8C)nJlfj(I$wg`=K*n0F@p!P0VbenB zJ)#j7q8vJVW-@G(IojjxWQkHCl}$+rs&EV}&9;TJm|yw}6+5gl>}M*j+sE5Y{7Mkl zCb`Z_M(5~mXoyJIo2n?D&;IB@kP46YLBoJrEtQz{Ne~w@ftD zbcxY4oU)tg#a!95Wj52Mtl~qQ7Ps&AF&FnwAyu=yo=g3%5Zw#TpH~-%;m;qDRcM%Rc!7MRAd>KA1z^e zi}u(wY=URfYeK?uFt(c;Wty$x`iV6^Yh8Y`A%91U0=<}a?=TlS2CzQUTF#C)6~cBe zi{|8H)GiMul|04#XAN01rXuS)H6XIvA}U>+$&4r`D*KsoDmEiC3q{iBlsAWFwll>u&yjA|zzP{COwPWzE^xf`?Y@i}(4t_dQ}(k>4e zyZkkWj|`w!#a2`rJR6sHJD7JnfP?ePP_bGMX0MpV;!ZP|c4H4GTl=v)a0kanCR4uT zaTZVYWBef>mNkx{$C_)@tdO4zkDf82O$|B>Kg5-Ti%Gn{mFB}vGHiT*?(Ue!tK9vm zE8EPW&_Jqqe_`Db9rH&Qpy#l?3=#X>*(UbMJCG5X_R-^9ZuU=ULih4n$vy5Umh)?q zIPwJpzcaIzzdcO(z9+eUa3KlzHq&Cn8HSJV%dM^Rd6RztqXI6`Z_`^ES1-)m0b^)? z>K+wu3})T$g6t&0Cfn$#)6O)rIySX3}2V|BdaU={sG`vE2g= z=li_3J57(4=h#p)TJ}FGuB$IMH_zikp+WSr+s3$4j`V6*j68V@^W=%qhWwv^bU&o~ z^7!#%j5Bo_Nl!>+Q>r)e=g)5_n?`;-X=+3MM`!9Z^85Hbf?OHe^0=!as|D+zi zkjIa3b9F*z<%Vg*d(1NDz{Mn#)0+Ie zgZO?dDT2I=p*0@)@*x_JJb2pwTsX+X?sN8GEP1nKMr-YkuWc+ZABXcrq~AJsDT@2M z@cHRe>;ke9^Wq&Da|I9;a)VoMqVURAhCV?G*3gWR$905j%M(uVc*#@JZ<%ez$KtqaK%L^XSSX zyxc^ip7)qIsxAsAU&`mtB5s?4n^$h&o;x4<&k=_68~QGiKXdE7o@|z}$TQ@|(^kie zhcC&PH#;_}kDS_al(&|?RH#yw0CyP?uOFdw&54hrj92%ckvV@(qF;zS_s*Mg?1Pv1 z=F3jhlMo!T2V$RE4~L3%vuuI5={|CD^HJVeXA*H%A;3+BF5(V{_uV7ZJ%Hx5%Hkjj z$+J7>NOH)Ii%vnt>{(EUeIU`sn+*2JJbN0Czps>6GP3$Q^XbV|?!JsBZ>h@oxoCLu zGKyRQDPIVpo*d)!*$A|`3evJ-UQzfHxN`mq(Q;eLRw<2x$b?8~pWp~|IaBu0#DC^( zf;9mdor!pLlP8I8z<1Y-#s#VRUA*>$NhA!$dIEVo=Eh8g=kSBk0I>i*=}eTzjIYVe8sFee&dQCCH^o-oBn% zuh)qs<@e7pHN)CUh9X%hYN@Y57MPprP^l$%vfm$Mf~AcWTDcs}Us%I_opel^%&kzN zLPm2XBk2a|eSGfRIm3I;#l^*-JB<8T(o~QyFbeWNg+JnDB|Y=KAWyG+6XZXhr)O6% zVfA??uG=bvHN?HxM5_@I98T?7HS*6QHa7NeHFdspPH6(RWXU8@3-&HX#B=&MkQc4sV8#y{NQZu7 zc&D@$qWarsaGALUvZQBhSbGM&2)7W6nYkHJ&u(z`%oz^sy$jZsB0R;eRc5Z@laTROogc8sJ)q=vkazbK-fGxm`G z3H+8G@{1QQGJpPjgJ0_OjP!Dqdh?~;p%lOF=}(MEv&KrF?xbEwl}eQw`s0v9f;1VG zTQ`L4Sc7%`dQEQy(;mrsU7(&x5Vg*%(%sNxdp!u8!vZlQ-xroG6^vl|dz%5wvDK zc@z=2Wz9(jYw-e-$$0Z-R?&0N##2 ze%#Slk|LwAbaTN(9!pe`IT_r3{hjz9(I@ce;akJp6FEhm|2rfPT2YCXczUD^msiGq zCdo1bw(@A?RxUW%{QuAF@8S6T9xS?P%9KgdDUju>%Y|+Rbn)Z+zO;-LK{*xfzy?Zyo!NK(H+t=_ZG(97Uju$Up;P3Bmc=4x4 zK`y0H5=hyzXE)k-8cB1qX3fg8XV3mtf_z@J{Cw_romn-VI5w&b%dA@Aa4eW%!8^#y zed-sV&fKG2sgr*wjr!N)-nKmyUa*hmiAPv_`4yor+{x~Hjb|3cun7&N?To%0YTlGP zfz>Ev8O7CS4(vQWoA856nS1Un-igsf=WEK+mP-6Hj;3+1rqt-rg^;O*xKi=}+j{0B zS)Rs|D*Oh1DagaGt)j#9%LL`mL`-4=O*=QBdtg0=zYL{S*84OoxRrHx=ku?x?*y8d zI1o4e6eovOChq<^+zNE(yk3c7^&Sd#ZiF*>;$vem5klYIQYH$Jn%Gz+PR@3ylHy6$ zn&IS-60=&FL{hREOVMDmHZvh9HX6O919sMCoS)Nik^8%=0(VOGp;FNAD7Nnhia>Ua~8mY76roa`~vYlw+Y#?i?!RaA;}#Ux|z z>}YUApx5e9tCCThS|U>`P>OX)gj$;`m{h7hfqRZqS$>@>Z(ONSF#x4Fmt1RZn50V_ zEegLBf0BsL$uRNQzo3m`YKI=Y%#sKDFZZ#`(~p^b%BF7oIhSTNr1GQ~Ud0EKQ8Xl* z_*!B*{3=U|h%omu6w6|VGCmf$i8+q;wuTAblEuB1**Rcosu9Ax&f$AFsm3 zPA1Bu9A{@|PM$nT?%cVJf;^2#OF=$%-gcuP|1-8S8}jq#&r`N+**_!}{w&U% zIYXsNl~UJ?7)d++>Ne!kIleWlQv~_KnuXY(r5l~|=-6@a7LzuNV@B=KjJ&v$+$Ilc zQfd}6_P3=~jh&phzY+%_Is^L0vSWxZd#*eu`i%)+o?WK&kYTi~R~rwTNct76OVG|M zwDwP?Ti$9kzj2T~rE22TYcRzvLl`>l5(mx>p-uH|9D1?_cb$f)uurHhq@GNfVFJ1T zHQxkzk`Uwt7*eYuWtU%|j&I6#wc;ARiqFNfXL}}g^`l+MO)S1LhO-+t6Q#2f!cLD? zXG+74O<7X9Hiuk`aOS{t&Q5Q~!ZnFZf3cHGEyvJu>r_sRYs1NBT4KG+Fri2ki!Q|A zV49gB<8m>f*Cuq@WQq)3LyxRa={$G|R<;V{IlD2tz$4nvxrej072TFi=Ty_&95Sm- zqteMNnSO~DV;3@YXibCIjkvysmPWv4N&G`{_IG zJZ_F&RBhqI&Sf{Swt7oMmagocT#uE#TXQ+W99h;ntesk)F_oJVlP@Q^%hbj>nsthzm3vdi>@-gc_NS`l9-4L7i(?)?y7sQc)~?I356VrgzHNEGbRrkSOfb(; zkJS^Kux)H_4uz_T(7Li^d=qAmm`AiC8UJPzXkfjGip`GDepqvEZ(NL~aCeri8A&cX z={rXPeXG@??)nQ<_A*=oI!!ps`t;*wv<$Nx4MqGl7*U})i3M^~sAeTz&RI%i-b_4w z@R^kdcVKyPI{nwYz|qQvUaJ?u+CeOPCd0)%3$5FEuw>RAMoyW;+c$5>kt2sukf#x8 zDagnF*E4k*`9~s&h4kL@Y^;oo{8@Yxvwtll;T|3y&eNw)4YMQv5*tTnoV{}}Ytu&Z zxv5cTO)!)6g}EhWGU@9W*xIG`9(wuVEd;bQu_<~DNhSfTI5>v~b9+!IZ*9)JiO15+ z8hfb|lw>TeEip-qBTQk2pO-tPP6b)MW44GR5eo+=gSm!6slrLb>*-{XF2wlHFp+vK zU-2%gIOS8txP-Zt$QPFalyQH~_B$W3HkTp88s9A0$rg~6fPer3vS!5=6)ML(jB9Ak zh}kPSW>JZz`J7OTf018ek%ygU-XUu?ZQshF=^cpr{2uorZCJ3hH~R-nqxj@?tl2k^ z9liT=_tsh7m=P;ZN88N11bQ4Rd?=vS{vU8Z>WDukmvjK6)rs3$$crsu-8} z6!MNjqG9kAnWc=CLTHwqvR=gBpKaZG5tgh)+>#Kgq0 zdh`M+%n;|=+ndeeT;WNg4Ea@O`TD(>AKlCQ)O3B%`)MR>x#^sYjA8$gJ9HX8hfQ;a^K{255~~bn_3rhA%ou`2 z)lM`l-ijGxN6|2QWoGUemny~u+UI?-e|iQ&^A?V@kJq zQ|VBp5TT)_jGr}+F@>W!c=!s#CSPOm{xwW*>%!6nN6;n3;a$2jbLMxaV8POOBqgE{ z&v1I~Bs20K5EZI4KZy||MvNHwhaojuGi1nM=u!K*$0R+9|E3qDIy7`vjCBJa? zR=5yCDudS+DSnka8HJrcL0OWBH}|7T)rvUE6=*FrDCA1RF6UStXiS<7g+nxLt8I z3nQ@RF#1(7W5L*d^q;tk7*9X31uUJMvCt) z*FzdN+rrd+yIC=`4!W2ml11J~qk0V2X`(0D^y|6Y$Y2wXN^OC^hcuaj0t+*(*iRtJ z&G%k;ynG#be(^!-S~RyKeaN2yUfjOS=`&{y=AUOypW?xrNK8c|(JEUh>L@R=Pmzs6 z{`Q8My-h@8RHjZMLheU_)DPEowl;Wp`xqK4%9unw zXIEnMxVTDo>2`QIiTsUMqEJbbn?aI1b4IWFkAQfd?GP2b8y*>0KBA{Y8ahIo`VtIM>BJUH^Pj}ImdzaX}VLcl+Y+%jKorEQ( zZukXpAMSDIX+-K;3L)pu6DD5#H%^`>HZ|-US{|J{L&SeQCR4@LBm21cBrJ7Zr1{oa zjs!mNL~9;=y`DR5bMP~*tk(FTXyg<>5o** zDlQ+~$K|Ktsq66R##xS@4$)^1?W$!Dn{ zf1LQ&54ip^Ds}C*AoAkGRisz!!{Y~8FXgLPHf`O>=j6ZlxCBWIXDe5eJg$25YK734 zYE(KuM$c-)ra>Lq`M`nZttw+_=|zMBh#L~o)9GF-ME2m84$(xT-^$PQ9!))5N z>%b$gCJd;PpPc2&;$I_L zB3+$2TXg+~1=%!a5?iOt!?xaVKHb{DqX-uY7b%8wrmXZTA*c7~wJceAjY736q85#x zlrNeY&?FsW&EcmhLRXNnTx)_j#GvUr*|BX2niP{&0{Qj$_!hlDGEnPK~${j5KEQ#?zy z_+^b|;gn!r$IDR)ao@0Ee%6ng%$7-uu&Fx;C-Zm|O6gqES6IDa9*x1ZDseUPoA;3H zRa#>IU?Vek?`6s4kx;!Qfg(Idg@&|k-BRRn3tG2rNBKP7h8d6(k}POGq7yA^b;d#~ ziGGd2q$SD1mmWPF>DP58ixw~C^xY4l(I~cwxGYQ7Am@W6tXa8;W2!nd@_EVhEzc<$ zRG6%OnJ7`EI1g6L;J}LUyvx>(oNl6lnVLtwS)y1l{wR?ttxtg){d)&7vF{jm?byb= z`LlTFSW4vEG79N>~BU=)DzZh-@%I0mXxShnvMmc={bG_OV{3~ zXw5Pxl0-u*wLE0anUkl%+ewU%HGK6l^4CPPPca$1Y_ooBGouZ8TJlG1$R90gP2Rre zxfc3?VjggMQaeujcgJ~ce_WSbqH|zMkCs%i{@EWnzMrXcUEM4kFF1=H<(!BOKg*om zRvh0w=BMe}zjAwBd*;7s%chAHQ$sWiDo~h$yRT9~^#SL=9KRU<ll01*m)J1r<|f zOaEPb^Ftm=HES4g5=g0Gje4j}6EGaz=Ka!}sTUdD4p9vj( zsNvI`^&hWd7qWo@oj0;_^8qSk`8rAdzw-O_x1`Lec~*rKFEAuDz%d-L($bizN%$(~u7?*Bg^ zd7DX@um0a7`Lvd$p8wSziVY6t_|B=U95#~fa~JbsNqffL%geB~g}A$X0uL+9Wo=6f z`pme*q6ys%$Ne6jEbGJI_(mKVRz5Z4KaofUulg+ia*V~sePSM6*+7VX)y%N%pt2 zOTDxfR#s>f$*6TESc~|j-&#|1tSnOF&})$^by!=OAs6CQDxsDlzhqh^$;xkn?0?Cx zd0F}V;0ib2Mq=%lf%4^o`1t4}ne+HzqK@L`^CW_D|C$#N4euVm!!vhQQoX10<;ipG zb7dnYVc#1a(w$!d!5>rJO!6&Z~r?;VW zttz;gDYPThJ(hKvE^62j5R)6Z0mP%z?g!lB);};pEjf$SQsBNaoyu ztMq%2edWjT=Tk?7i?Y352ePBj8-#47RnM~Nbizwa7GoV{-EHsgao$mux%rjJVHg%(BR-SE~==y~TlTOUYTXGlK5~R3szny+0~JP zrRrhw{5HjUwZZ*uFe|TE(x+uf&a7WfoOspgT`~}I{Tx0Ox`<;lGptl;nqR(7%13S$ zm3^x+^}{*xKibc%71uEv+!ppICV`Hv7l+mb4b`Gtb&bg3iiq~&T!y?XX+I)(nh-k`o z>`3&1*<5*JPlUA_gZg(Nqe&Q>7O&)Clqt2__MvP(8%{49&CU0YMB2DBVnk<-^exIb zA--3PDon37gK4|-0YQ74v$gatHnq%bxQF|8f5L|ylxpSy8GCEiYdouOV-fshFuQ^WL8(;NC7~ zF1x|tx#M~A`0?LJkQ@1T{F)&DC-L^&a+Y7q&h+75J66&b?Z<2Eip)v#0$*pY{wMH- zAr+@G`0OG)QbT?#Mz@D)OIizZzLOc>qY8%>j^O0+l^nRM8V>&vUWMT0syfl%`-^l6-ri6fVY*j~}2?|OQLEuGo)-ZYp$qyeR&UAtF^|)9AaObXWfBEM1&k=>Y8&j>otz};H4aT z6V2+@EqRu?DxF)GVaJgpL_9mk>}?Nd)U7?f@2|07-y?COjx%fRdu&Z#GHA$3^41$b zS=m#Xj@d_!pmG!pDvcNRsGeV?Y0uHv6mDV=;}W+v&Sv#Z1>HL}W#y=GL=j4_Zu2SJ zeShLT>Hl)$0%@&fG>& z(;isfT*mnGj`W#0j3z$fUd`UezDd2W<|Mu_6BdxE@a9jXTv^?y#l%7!5$ zI2EPm-HBzazwbo5Hbt4)s43xjTGPHs0f?7OcVy_~v20x-M5asmbZo@P-yPqQZ5h@3>wwC%N9I%fA11~nJQ%ZUGC%&it&#MOQIMxYu5Vw# zwJSSl)^q?*t{-IGW3aJG`6y>%DnlLmnuk^;sh8aXvkZl)nmLX_OOp z^0JlW>)IC|nUcbln^VN!m8xy4iw4z2tew1Z_edGElVIb=wzI(m-5bV)LthMGCNeYX zHg1Glmb_$$mGk!FGoCw^rFvEi%)N?I(IwMy*1Why$MYF2GE-9=oZRs6aOBqItrV}{5#pW`;!uvNS)@3NQ!85}!F!IQDAJNZ zR~hyN+K@+kg*crHPOhGqn_82cB=V|vH=eGV&h{gTG_9K#l~N<}$`X4U3(j14ME$m% z@%7Bfxc=kGF5>aYpO2zhZ3%n&k{op!VrOnjiTX8(dvuN}eMb`T?l7%JPr)`Yr?~G= z39Q>FWuFE$Nql}C#|&OLOL=ALkE5Lfl2uGxa!#f#+r`m?%jjL!gqAhhk!YV47k6*0 z5Dlv^HSPtA(V%uQWbfXIW|t|Ma|cnQh!@#Q<|FFqCvIQ7Lf+a7e z@&&b%KP75Zr?i`rcQMJx%&jO>y*v)~T6Vs)r)TXvxMVGlzfUHSvpVT!rRJ>z*Dmg$ zbi?+dr5VBt*NRlmVvWW)A=E#P|MWHF?~2UA279}&Mm9#$22q#0e)WC+`}n7p%fAQu zpG-`Rq!&~n%->_it(U>%6sw7MR#0y2d~ym=B7MeI$>qpgz3`2>#kC|TZuOCKPfY2% zq&s(g95_4R5LfCyz^3>Lmh3v75@#ABPmCpZxrS5{>HCV(+!amiNtAjxeeo)K-@2l5 z(R20geX+F|ClBAEK*<5f&uvDd)1g*tiTxOYJX;;k44J~zVje8M+6+^jl4NN#q^VMf zY6Z6b#VD7p0Ats0A#2n#_MeF+qoaz%#AJiL>92p>*Bd6$(AX6xe?)b*dTn5wt%`(X z6w86mGw$kExkP~A0#tyiDXCzp=JCtuOTQIA}nYS!gjlMb?J)ZJEu zm$$u9zt!>h#Z#iirjN%?lBq}~EKHx05GT1`P-13hho^%Tv-Yl~V9wfQm9%lM%rf=jt5DvXk+SN)kn0>9lH+g)lFg$Cu5=j?$!e1vc#1PT4#@s1)J^ z0^ckdd3N$5G|$HCYu7OK3gqeYr?econ3B$CC|05y(+J8}2rqLO5$sh`hr7>14X@%5_Y-MF- zaO3rBNDtBb_wT7uqXx0huk+Tu6itG%8@5@vXX5#_Qv~D-#4%$oJoK@+lx<9h!g3al z-9+%s8@LzmMa!a@kS9GObMa;rEmV-0hwo_8tr^Z~U^@Ed%^Upu{E!JD68qsLwt1_N z%i~+`w3&ToeDvp-wB`(+e!0mQScITV@apOdP90j$3!j>dZd;Xzm#@fFrZj}c5Y(Uw zk2lU^{>B5C78%H-HpTh;@+Da+RKvqe!JF5Kl&)5r>bca+oxPY{7q5}6d>sm9H0Ska z6_v{d{Y;QccAku?6GVdgwX@DmNgX8${~8D4oyW5WkD=KHDR6F|1(`lrbUf*l~%l z2NyXR?atUy?eTTATF(@o3!=O4*m zw>}NCM6+<>PJ*vr$ERF>8W;8@G2toM%e16$;R3`w_(Y2?^-;WghC|_6?USq8qq38N}Ok}T_;odzBH~@mOPrXtX+GVou}{7wD(j> z7x3cUrENS`XC{+qI25Q*0yiO4y-U`hU?#oDE79;P=0mj7l~z4kibls0=C9t1Q?7DU z%%6!5;aVz{E`(E#{BU6zdrv>+;C%%X#}2{I^cAyb&SUqnk93|eiyE~{p*y#jy{E)J z55zuW2I5XAktRNr%Ik;z%Vl;va%A4zjy&DIob_9FaQUqT!)H$-i-#?5&TZk5V_o_e z(lKT7LaqxD?&DR6x;66h;bl0*YL>@Z8N;(E2U@gfipz)1Oxbt=`z*N$$Q?wFrd2pI ze;OOFU&GEd3uS9m$35{qI{&g1^s%98t?cZcJ&t2FMQL0rcti@l+_SwjPk91$`L<3v8cP=h2xVgC*7vqvH7O6Z21`3_v=x8XXM$!hU ze*L+d*dN2WYmbbBI{ys*h?kY$hU5jo3hN(VHvV5y26dK6lS28U_%^8X$D@^pvT#T@ zJUecuMImeAp01{D|47asAD+6$e}P`yQ?0nCKl0nvuf?g9qp`G3lTT#o_+-per}X}J z{FZ(G8Yqd4mH*AWtQh%E7~RVmNv{|ObEX|q9iDcBI=BBJGbJPGhCg47OZ*X$@OL64 zcpoOEdl|&IgjI&3bnQ^a@cX~UE|jl{UbZxPym4>2xbY3z;q2O^0c<6>OW z<6`8mi&2mp`Q1o@JiUJcPs>I_-kLq=-@Iz-nvi5J`DoSb&+|NBBz^HuZ=f16V#J7% z{|@OrVl-L#6OdZ1|DVaq?%lf$W+1IwxBh8xVR}Up;-R6TxVyU>3Q&6N9hB1e<;xem zyu6Hqu8gE9Qu&wsQA>8=Mw1mIMvNHw`;wL>E8`a!CkFac_)miTkK2&{ZwL+!HrSA- zXBSJSPoJi8<;tmRMvSB#f4`YJjTkXv#K@`joWjH7Jy6H|@DztwgT+^-=F? zr6MKIk`hszJrTqAH^eB>lJrDmAI*l5+NJnyV67nCF7aE1QE@_IM zZ>S?82oL|)@}d7_p%CbQ#Z$nybS8gGr%p|xG#QXmg+}CcN?!i_SdA(rpQY5dKRZ?;FkVg_l#;Bs9!!+?ZqUBRH^p z6JP#CgC#SgVJ)sm6G;A7MAEUKKQ+c5OkIbS9ZFH4<^;ZcxXZ?UcTz)tFp8(NsNH}~ z7oYLu-c97+iMyzqt0`Kr8h!frqes`y%s=>mOG`#D|HvcGty#%^Y0A%k;WgbVwjwlj z&44AMtEoyovCX(BHv3T4v2d+uj4{+qWNGn$>2_mFKD3{xgcmm)w0Bmb#Wg z(%aLt?$MXdJzCRo>{de~;qC2tH0(5*DSg^Ab@yGvexDv+V)N8)H0ig&u>O_!+iNLR zVgL!L>nXgUdFI@->phS@eft>Fx&GD%_z+C5p1tVMs4|7iG@w`at}HwGH1!w}*Xuo$ z%UO=z1NzguR}Z>&o+olj$&?25xM?_np84aNGi2LULUs&c+?tfMNrY^gM9(!hQrC`v#I|l@SjcQ%032PVTK& zXqj0$RwPmp%lj`eSiAY-Zm(iQiDH!9c8~nB54idIk}@n!O+;u6T2mRG8C=D>mgFQk ziLtR*yL(}8ky0Ujn;0mR4mrxOE3gHL`zC_&Gp*_uGY8M;I^6NXXdVY)3XBV^dY#}b}?3;T0OD1;c%F3&Gc=~i9cB!H8 zi28v;*&1>b!%&*=v@o)v&v9w%uSB39l?d!JqXU!8Rsn{@L6;a+2W=g)z+a*mJjSWry*0+Wy)?k zPsKYu@tIcAvgB#7?3-XOkbMwB#MMl?fLG|Gzjk|AU_QFQ=?0%io zrzZ1e(@=VSY{=5WhiEbB1NEwSarsdq{bo(%MyI9}ShJdaEe12@%n~Nn8;Vl_Z$4a6 zG5^vGmKD#(yUHEO@ct@qGPhv&gvPAz-J9h6HE~Zm!(*G)jBBGMfBrsHt5=7Hefvt$-D;*Cdc*UZ=1d!tk)d0i*)hn8j>8t%BQ(LC@ zYC!$!gQ?!233cjZW%1X$!wNk22lQ(57_>l2kI<4jNAAqE1}T z-5b@czT`h}5u4?GS@Rz9nuM|PkTvf<&ZD+#VR8=aO5%k>xb)paNBwN_wLir6(_7fz zeHN3iEuphRL2?f5Nz$c5ICk60%vuV%HXnvv&O#)g+DvrojqL1K!jKMlMx&g)n11Ip znXQBfyuF?>lRt3dz(9uAsDwk+epr1t%ysh?Y#!)Dn`V=!(WM)=4{Rl4+ePHM-hhtB zd^mr6C%N5z(dtt^qjI4htU5D~wslu?fN zBBT0`r|00Vv}?JNLl_Lyt$ULQ$KM1z&OL!_s6C)@N@vX z=QK8~e60rh_wAQp4y@=|TyQtaeDW{H)=l!-(^!`wf`MGy8_Ci@U$!xI>G*N>pLqhlNL*kq(ZlhTYTS(sw`?orp{86}D?;nL}HWXivug=+`lDu2o7 zNjq7;dnT>gFW~yAb*ZUK;hP};K!>uU891v5GcOjRLBcW|nssJr-;+$69KiSko>W(D z;7gr33@`6PY+MxPNe?OCZWA|8t>MLnz6_3N!GXa-#D<-qWZ#QStC+;-J5KbgoEfj& z^>Ms4j6_S}xbHdR7zU zNh$(z<>2C!j@-`I7wy8K6q+}cncY`#_|htDbhjx{cr91&PM|@S`pkQM3IC6)$=O-S zlcOc6++rtZb_}O&v2M(~zL=g_>ofP2*yqD)^7Mwy?OrkIMJ@IWE6wxOeHa$glzl_K z_WHi2s#Os7t(xN|i{s(-4~#i=o*GdLg{U{->7hPipE#OVZAzUgc{pm*f-Sv@z{kUs z9DI}geOwuM&Y#Vr>ZU~Zm4v(WYBvP;Uh^4WPD`=kt2udV5sqI4`B5RrT_F1LN?MOi zKWEh%(a=duKx5-U9)ElKWzWW!&NFbkvYd(&57IcFBiEL;W~*iZ3;Px} z9Q$a+U?wKlW9L7#hup+ehRpQaxpg}6ayKy**C<1yQl+_ly{S0&&&JTC6U@!cxpU`^ z!PRB8YTv$a88MO`Si5#D<;s=A$H&Jg$kTwd?IGV`v>{J_=-9gM0`0oiM`P;4;Ev^3 zw(1U8N-tEsp+HElDZTz%x3^v)C$Q6CG_yyt)Tsj(d#LF-elrz{r1bWsCCTwIbeg`I z6|2^rkZ*W>h36i2`hD7^r7vo6>uYi5~9^u4pyVU`uf|S`{%ac{sLh zIW@CqAb4^s7T^Djjinj(l899)Fx86}v|fi68DQr>HS;Yym`ax*RP3; zPeu{@kp(@b^U~bHV5XH;n2LK885)c3y9PmeL#Z@&U>Qk&7{A#3g%R(u@85bx(g8`2 zc5ue3E)!amqk8qKv>V=^SDU8rCdnk_B`8Fx#yu~6%S148^k#Oin#9q#YShh?4O{(b zyffz~L*w>@oV-J+YX80m?nhxFGeeR1bB`Lf8A}u7dX{n1=CJh8Eo`mKglM+m%C2=R zoIQ;J8$QsqX$4f0AQwW))Lf|U&)4bPXE?{s-z6$T2});mMI(uDNuNmtRft@zV-qIV zaU%HgH7?vZ&E*G?LV%hZTCBg2h2Nn^Ce*7mHa1@t8!UtJiB!F1P#j&cX#)}2X}Wk^StjlU)A?-dTMo7@2=k6z1Ldzb?fh%QtLg$ zW2n%mvYyTdy^edZn2r5di^drnCRLu8R3eD#IYFr9=S{O|2U}_#;hg-%n^=?uw|@KZ zHD8cz>o-8|t_CGpOuWIzMYpKXX?M>5vaQYuqRxdtxaUc2wiXx{e-KlyA(Z7| z73_9JU3VokT)9F}u_NETf7o9PItKzion2NTxs$7VoZCG`psNk;Ms|4RCMHH|`Qgu4 zgP;P2wrA=v{mL4n6OokUO9Op+9T&g`ep0gk5@sm`_TQDQ@0DZe#R^%RE6q}Rfom<4 zsvtO#fc@7^VD$)Xg`1B9Ttcy|abMtdBo0@4ik3313Hg9zKoG=wZB5Zn)wPPA>P<#R z5j)eF6(%r*DfK?*9b1RPTuS7VQlXrsW(#)Tq?0QE@W~~a z?`KXg(%QH(yIXSoL!Sv{x^PgQ0V6F9`EsrkWx8}hqoJuurd546TT>%7f>By{Z+rr% zWL-ZrCiO>Q$l>@2KarTApNV)v2FOBX>x5!P6&*K~g-Sj}6wN08o|UaYl^~g1uC(kO zEtMU3!{aKYHHsU%tKW$ynVn9`@O#a!9Vc4#z2Zdz`_|~ke3>#Y%IMEhWu!UkePaBw z&97kYLp*&P_jn{ZjnB94VG~i37!o-U*C^LM#~_U@ep6uEUkv z=AJCrUf90*tD7|>HH|u6rA!z?R8Q|bpRAS+6*-M5e2!g0fza%lhtX#Q!)_ahA+ST9 zG$93AE6$bzj!V(-T4Y$n=r{vHfI@nggt+FflQ02Fl<{|U^qosL>}=l%b2;X=(NH*~ ze(C_|P&Z6RD1QdkezJMST z&0JQrO2a}Gwok0Z{^rBj$}N$Kb?i;106gmtdq<^ccF_-|&&O0n`9Nz$3M1JWb*&u; z4qYD4nSdZDE=Ti0Azq2G5on!myoY&y_oNoJR_v;1c2aR4kgz`)*PD{Nj`J8~tt|P} z>v??&Ge1sa5yVTNhV_7(FuiU+sj^w-7D3TT4K!~@TPUZ4JbsbKKUrc{t(cN_{J0!F z;%58dO_7iSPI_`y)RG0SzFm`+3{l6O4{^tXv7xZAO3oZRZYv&43BK~=(iw})ZW;=u z)>^bvvv4FJJR;E;9b8gC9X3wDSZJaZ>ttHU99O4EX!K*XzHwGBk}Hp8&%fv^20}?G zrCbF|_#7E8N6^nlz2Wu@*B|q(3N;!SO2JLA*m;t~%yJ>^<%SZL)PMT=2Hx-NQEyIZ zaD-#ZB1+b$=PXI)sDAQP68mWsB`$AOOd%YhdjjsGA!n}=SUW-Na}10OFBXbbKwkJq zS?;aVW<~JQ6ulb_@NkCzr;{tq5!AE8@u#CZWiC*mf0z~9R zhaY0egVI5J^~#Ps5)0sox*xM5GoOjO%kX1?4%y2J>Rddhf0BkmSS^M`9cbEiuOSo< z^eY}eR9t?w;zBeP%+eF#(oQf*PFl30$mMKL)w{L(#S%Abx6du*VX?~YMY>Mtoo7~Z zyim_0e91Lz?@+h<(0M4M%@cKxUqW=-JXoh7t%hV3i_;v}O)|Ig-7@%3!Kl=l!P747 ziAe#%vwrITPxa{|>mqwTHMb{pmYz0aeZal;GY;olH=!(ugq!11G7#C)C5^hy;9i6D z*b+2+{fGuCrY%zr471Y#vth|L5x8-Xj^#%pHwMj7+)m=$>) zC1g@roN5@t^LVYL0N&sWE>tXyVp=HnO|tDf$|j0~+<*JHOC95VU2$@poX)04WBaVs z-`?9MiY5oHJ$YTS)!=ZL@+a82W0INNBEs1RWz#%*(Adj$f92k|Jl1j@~0>`gi8 znY%NVfh|e`JOCo-x%7jLak*uMa?%@6Uhd+qy z_Qc`G^<}lw-LAOF!LDlla(>;F$4+6_;gnChc0bso>iVLd`mrA2E@GPRTE^_~ma=dQto%Zaym`JNRh@6j%Bc-wMyv21zheJeKHCM9~Hy(f6$sUt4LvE8! z@qKF+&L<;W_F3^V4J(1ysw&n@WkR1U+e*w?%R#en$z(IJk0vlbcpl?FK=xzCi$t#%VFdMI=WYj|95f zKT-VBsFFycZ(Rj;jdrIsPB&jL>EjO7j z?h1Fbdu7%yeW={cB*aq6V{cnX#Gt}Ct?=jL7(aBf1596Tp9fM#B>21JnJco==CgZ4 zgu~jKBa|8LR?^E9xiw%6X-kX~$OHFeiss@nTZ?y}GblT54u9D>P-N@)2!ig1Q&nkW zB=1E3{LP>@nrF`S)KzI5nr-qeMOp|W9ppQ3!qP}xHTYvA8|3b%v+5eJ4((bnram}> z)?L$YPdz1#vUhZ$%w%pw9hoYZYswkc%|EmNuIqdn7cPg^hP=sdUz!Qi-yfvVX|p$q z(|I|*+*u0C`=O9nPU^1)zgfL)!8yWNq0v|BiRjEuElin4DH;1GNkYD|>xx?%Nd?g( zgzd6?{P8s%4g_wj6j7kR0CF?B zlQ5eBFY)JIFYou@OJ6hu#&$4H+#%kd}o}8M&A4`(fa*o`@Pas`RU|AZOTE2Vi zcv7&Q{b*&0^FJ`$(~3VyuVP#Qj1(hhwyx;5oyQ6+NJ_${CIVHG5=MTjl(LkFNc^6} z*$pz?y3(#jBTzCiM6X;5U*&}CknKIFF$>H0bDg zt4I8?UsSaNEN<+0f6f&4@ilQ_NF7bSWl&z;8SQPP1==U4P9v>2?JE8`iXl(Sx;3wR z-z{Ib&p~^Af=45dG~F#^1Ag4-duJ(y)H!T~*==HbL(C%iuR6U8pQMZMW>7?$_kl)b z(plrm>M^esKeod0*gV*2jTW9H@j5Zhe#}w}r}9|y?uAV4=vhdGlL%xPxo^QlX0)YW zso<(xf_)AS5$$i57~oX!aEGH_>9Zo9X(vl=j;X;ZR^z%KDakO#;|5hj_ zaGBD<2C#cWEM|A^4ukIg92JLq@~aHy!{HkPq4hcIEjuMw>dlXJpzWYUaP=4R^VsUY zISe<~{>Vb|DIk`RB;Y4tROjfRL^C$kI-Ta>T6SbNl}3fnxwnjPcn@K(`8Q53-s-FD zw`*!1JZtYy^YhPO^n|3k)QpVUCOtLV#g(bpu_;oK?2_d`k29X8AC~bqm#ytxBygKe zhVM_XWkg!R=+r_Vy33Z^$RS1TuMEX|a%Kj-LJM4viLg``Fy5G3GHOC)duM}#Cr+Uo z>=jTK2lM8Id$0s&^7-c^#iwo$!guaW2Q9uMXtRaElvw!HnDzobpYs>{@*8r;v@hqmUN)Hl6KCl7!ra>efpqhS^c z51`Rgnahqr3&$O%efV1`QH9NRvT*@ILs7pz*7obzH-;u9?<>S&x=p#kitbbZWm0#+ zXn35yIJ0J}>t%MHcbQ5VDs_@WVqx5!AM5z}!}mL3 z7wn{}dbK&RY+kWU#-?c_W1)*2_=$In!y{{cofrG|k4u@x=2U7%nV>a#BHFuFK3_qj%C1`Mg z%z(H~DJ!|^4BxkYIyLJR=@b~NU)N9tV(j_0=iGla|E?Gi+nYJM7EkC375v-BYP$$0 zN-vB>W3AFmzQ8xjt*H@-&mQKu&ofMDTd?Nwm7cr1x<9#1RsD${A? zVnN*KoxFaP8iW*=*OxlHClhb_67G5|_|}L#>*=Q*(Kge$hn&t~J=p{|2l)WIbXVFN zOSD(IZt|;I1e>SHk{g`P0QJ3A+mbgzvJ*@ncqhU9D3v2B*XR?vsK4!C;5!BNwVMb# zcEKIYZgc{}|A}Y)vUB9H3K@;Nm+(5q51BGjs(#=+_U6iJktk6om)e(|fm7VZJue2~i}UWDR$}*|9_KyNeySry9$r07;XT;OG`-*c(5cPr zoD6{@0tVwHvD=@Vz~%=rPV%)NNQZ;^Z6Dag_I-pD_Pl_+^Zqwb2le-xVjTrj3Pt<; zP3I>v*ZIO+Zl|Q0UB}gz?jr(ot-F*btZavMTfA$5G28xD*i-cGBZ&^)k-+oc0-wee zi)!ZmzU~$4b-v7^H%bM)wElzy!Y0#xgwp76DM&= zwU{gsyw$EHvv4NApQ{i}@;?~Sik1%XPI-{9EH(*lAN zw}gkNB8xUOMhEA}5YXFtG&ThO$&nYpwYAaa)BB(QgwTKf6N2sFmFpZ3S4r0xG@MY( z2O9dFb)0aU!GVI~5_G{=QV@=4xJdRhS?%C^xeeNNovLUM>V;P7TX6fK7!%>oAg#ZL zlS|JP&l<_5jf*l`jX6C^WZo@UpJX_V@g1h8O5Jj@=?__hFGQ-f3N*24B>>r)n!3I| z8S)2ZG?lh=q6(9HpapTiNN+NI54uxYv`P0GUY1t&pzv$$^^0!2qOs|z;OZ}P`Jpu8XvWk3*6ruq;?7J=LAZU*dCsJP&|6Wz= zo^a%plrCp0D8An0gdZy02;~{QQtv@lCag`dLD!r3c^;0E)%V_`$?4CfHR_V9c|T1J zGsn+kl)Af3{D!n!r4n6e91MGMX2q|}%G4^fbkR)%ik3nxp?j6uzr!WvD0y#pw~xZ5 z9(}dr)X;5#iGKKFc`y-TWH-y=pqLVgvGR8L5nYyj?)v>7Lgmk0kD4Jx^_YvNti_fI ze?&z2^9?S(U7ZmfJX0GoobM_Gzq#1Cy-`N$kdb}P?Jht?7-2l?=v1c>3HU@uXC-7X zfBGS%EX80v=MD;GFjFd={8qQ1WomBj(Rp^x^@U9eqxGn0jcirEqwVa_F-SoFsB5IiRkOX>r^?!$_{y7~kJxSz-2s-+`t3LzJ5+ z8J61enm~8KJ1h|PzDHPh7!CECE#0We82!;{A@4OeKN7zqUTU#>4Y~wBJdl&O4&#?q zG%xxHz3dOVh5~0X)}7`sNeP473t^#{^l%@o=- z$M7sdoz)s!60R+~ot{d_zyC}?b0N4<>4gI#6<##TTnQYy=5(gLE7_oX`tXQ=13<#61$(LKVg{ z`ia~-L4bgQ(p=cKOInQRb0TE~Ok0t9rGiiJ?)c#rATEf~aR$n4chEkG7p9XZ9*rfP zWkhi^OlBe!-DRkMEXqt7cDcUuf(-23O&UuP(qwTwT!KOc{rSs{5EeEXe0xBxp6QXn zk*_dNZ+7_gF8KSb`oeAwncMA4ESJ-7v&hqdNTP&X3#bWO+x;lkkDF1os!=$le==$p zguJwl7#H~b{$ct|v@(qYVPZ=he=E*Z0`r#P>I`l5(NT!K4xTMF&Y&{r#d6(Tl0C4) z6L@^Q9JSAP`f%9{#a&|+s$dApm@Gv5<%q_Hre{NaFhG+eMfHp!1CI2>$CjWikQ{7l{9V{qd&uG^V6#zHkvfx2v3_q=8^Z8RY^o zgkAp5KJHSSqB?29bEt=pBQ!l!g_Y}umJbB)DFxI@#2BU$Q+RxHV5t62^= zO+-GmQlPPTLVXt8f9%vTx;XG{-e40cZ*T7rlj5U0E#4dS;jR6QmV{L^@{vo3gr&?p zk^NxML`FzQT2?J=)WJ-25+%)@p~a+7=^{=YI+cI@M5Ykisj;&i!@SxBsc@DXd}RVe z(n>a4DJQ)UmZftth(XWaY>~Ov^M%%B!&B_sHf!X7QrLJ`aMr(7X*#o@|#&F6ym?#LrCsm_&Pn zkgkXWL^+`^s7uv&+llzt`3Ef&#{xIT)oL#1l-KAqgrQuencK8${w&LiO{Vsg*xYJ( zpEC`PtCpCI8UZxZ;)(Pn-|&h~{eVSMa~<9;?30-jRwYJ>G+Lp|NjQqLXE5{X)?z93 zjAXFMd4R8W*Qx6fR-<8!t|;MLdgi-paG>h7SbsOCgyF{wreHM^NVm~Gq2vJ3A-t6! zpWbEwK91SPz=|TjNOR2>0VV3oZOVI5#wkC5EJ^{9uo6A1rpB!SyQ08#@ zv~{9t`vw*J9S~DAfq+!7(Y*z*g)xL;a({cDGI)YOSj>ZEEb+nQd}Kc}`pRUq<6^~& zPRbqM1sh_NO83syqEU@FD+vC$;chgj68SZI@HW8+xp=s5Fz0Qxd+Y^$VxazU=YT6( zhjaMZ>5$9og!E$YM5#=Ug_hX07O<+9t@T=Cw)x|F!eZ9q4ifTb|L8;{PL#C60|@P3 z(s&Ba`gEL(bbdhrLNW0t%;>@n7~c2v`ikob^~nP^IjU3tAR(ujV}i+NqV>vBDp%2n z=oY(#`)?-PY$d3XTOC&MF|WmbVi)cY2r5lqUHX`Qy1tQ6e2+iF>5BSzb@m?T_t7l; zxYE~I-+FQP;Ss}i{NL_vlEodREbF^EBar%YJvfE0^6N8H;Ys>dJMeHzEAwNl5qq%Z z|C$d8Gj=J?V=LLYyX$ok-)~D+4(hKT`gD3uSKDyV5ABQ7p?<#N-85#o5EETK2Y!d(oEM7Z7)=jG!=5E4P%KSrR6BINh%SzcZ?2(cQF z&>~9u{00S!b=DU}PV+xQd?b^VRXea_0i!;=5hU>&hyXq1}A#rzxZ*wBQ6Z5-aiSvEGQGW~99oQ5U9f)3mYBx|XqzSzvm$+n0`~m}0 zNU{9+n9)h{RWUs9fVa(Le8JAlZYwP-OH!(DAPj90b-#_Nm`hpV(aVU~{r;q=A-F1o zB1a-X97&Taf=lr?J>1vTexzrGo|xF)cVDEMRr%BMC}Bu91&o7HUjbyHkw1t1`jy8| zm_on1wL0g_CNZ(T<{+uHBdi{4+Rtw7u#mlW>S<7s$`y9%E5u53Vzfg*7nr4c{f0Zk zAY{JvU9oUdo$c#8yjMgH!e!{?HSs_YX_u=Kgaz=8j7^Ctcn4@A4t^BlMGpzAj|pl2 zjIOygHz!^W6{=XTfJ!@l#jgHI54Okx>Oj)EYzo&7t6nC_I$EH)Y2Gkc6NAj~1m$L; zpYorj`--c!VC6lb1~{E+yx+OlgEOxQP+8{b;Uu{-U7nsRo~pZi;-7)d)~oqr#SVKz zJM}n|X@2mF6}s*0yL)>{7c-eUu*$JWI3JA!b&kb#c4vZ|yQjup$!@&2jqTTG%Mn** zCF9qF+)hv<^AXQ2A1}!VEudgOfXmD;ct8Wq1rEDzmO$oDcOm5A$R(UyaI$Oul zdxYj zxsiK}!^#kF5WuMw-;5xJYy^X%V4h6-(9cGGRFh_O;YuGcfICm57nt9Em>F%PFKRr! z{v|COeYprh6KcK1AtE!ROQZrf8rRcc+#3~a(`)0}Xe|U%*zmC10fWJai9jxCv_uBO zXW(cmC(>hD%$nw?)}MIU5@@h z0E1@_ADqr?t-X11-m-J2{d0jbW3H~vnRYk4c9ZSkLfBrdyL$0WK!r`}%{8Ux-J*&0 zT0&5i^s?fg@#hVVTJIRgI;%+~YmL_L>rFO;)nnBaC3Zao+OP~>Oy4eR@Wei@NKiLl z(S5>0@L-%s`!fTb+b74iC3OOG1m4gIKc0Bzo?f#W&a{EI+sZ3($zjxsI7F7~f0hK} zo4#rrN95ZkqRsA~?#36ZCVmF~tiQTlaahTuW%*`G^U9FQk1yFuL|UEcYq$A{T2MmI z*1z3dZuS;lyXPaW#F^od9D~%ZSsYyw;|_tHL@%0g8-G2r@qTrG0}s4j_|fs&yKbRe z%@*wQgt+Pb;Ei5#F}Yc%mh@hil#!&5vPnbs2E$_S>+dz4qra2wH*MfSi91U+wwE+5 zn-TeP&13C-=v3NH<#hX-$8N=#-S*anK3A5%zck0}7t4r!a%3+bl0bwF^n<}{rcB4{ zGc?xws)fn>6Fd8vp1=ICTCaIQ$Zmhkg;0;HJMPFFYcdB8G{?t3OkQ?)xM@Wbr_Upe zZ5N2G+B^q`5WOQGaRH#?sSOsF1N)E{GlqW0I|Ayt%gU1n>0`A+Ab}@J#f=BqGD!*@ z23PVHLpF;%)hyxafUb!EVZGt6;~4uR=P0oPF7@q8U4XpPcND4YAh)hRfa6O3RL%oj z=P7C=uIK3*q9vCvcEANFIN_+7LXaNNYn%^Y*)#d%LK6G52hozdPIDI*$g_WQ9&HS{x?3e)_hy$Aj z4(O{a*j|KbzP>*A^mZHgx6LN~J_Afn-dIH^+u6)k*OTnOOphTGZQO9BhPi88FT`8C zMpUdbnDA_P1OioZ@Gtq?D9nn2YL1?@uRtqM600njS=o5Ox;~!KG#-eeO3`TZTOR0_ zA8i?ic0%3S`a-+e*cRR&NgBzZ{*Jin?Tgt{0|^GBkqBN5l$2VSbB2x|VVGS(Uu`DI zHhc(XuywNu0xA|DfpdpU?DV{Vi{dJci)&C*WVg9G!f!;RJYbv@Pe8UdMrhlB$%s3o1@|{t5`z*y1jIB z2*3;sc6%TIsaXc6dkp6bU&cw4_>`asiOCV*nNAO9U6)@Ytp9CKkr5e`wiOMtfOeVm zBz%O=hz7Y4?oOrf3#XG4x0KATG&6_xR@IN)8qThQzE zJkY13w!S|$1p#h$W>=aowC_4TdG^gdr~B=PO9hZ)cQiCLSL*EqaI;)Y4#jZP(ym^- z%!Ct6>~j3YbDlBi*-@Kh0GQP>8)0b-0+ELl)&W-Ip1j=KxCevZL)ZdoV+fNKzJ#sI zW`HWvV;W%h?fL26RUUC`*A}s&BCLg~FJk)8)`InxH<9%3i%T<~NUA!{l}$7U$i0(Y zsd%|=*cMFQUJtzd8ci95=%#TXcYzOnR{3ucOzWN}4wL?@=Li}a0VpxLwcu;7pF9oZlG;ip@xtOl>HQB~RjQgRU=*WOZ zFc|7wemuB;zwoN5*A$L8$(wog#hDWzz;w*45-8xmvm!_6Qi4`)KH2xPQhV>_;oM>H zv#KXa_toh9qXy!?sflR98HoWh|5fgd6_m8jVZ30TP;373`a}g|&(lXz@hsSIrWxTd zin&|XH930}?%h(hgt*Xt;7FUpf}ddK;h@O|Z8n*Ws2y^uuzsg%!MQP;dUcTixbpM3 z>Ph9p;`-prG@lezso>Jv#Qqu4LJ94et)nBgvr%MB(eWX{B9p^7iMRZxmN?kfMzKgS zZ;XFJuNDK7Zvpe3vI1Tm??nKBYwKCa&@s;5mv9HMspaq`gF|i@NDA#j?+&N^u%g&# zY6aiXiS`fEshksuOyswjaLjPqUW)vXVc!$k(cHTdB(EM8BFAoi)?dTzlMHA^o8?^P z#(a%NPwebZOF}&_uOGIj9FVtq9^b?meT&ugBdW48w)4C@8NE&zRv!0gLeF1FanOIsY*xeXC;Z4b5H8^fe1{1Lear1Uksm#;h$>dc8JWu22$C49yD<6wR1LLEiy2F2 zz1q+Jyq`VD-YJc{x-pxYFWH;btRofK}CE-R>4q!&~ zA?eHYBFJ||>2U!4!brM*pXYz4)?L7H-2x(hERHLD91PnV7I3#*uJY7gKiVlaXi=Hq zX@rpJZ9h=h3iVBBmi}Ge8=HKez8`+s8p``UF0F96EA8OjZ>3NorK;m)=w@2bulahr zoSN8%6oEO>vs8gDgZ;{~YnAwW=)+m#q;V#DIp3vos8sP&Xu)Zagu#n&6LuZ+FN0vv z7ikNE`J*Qh=mID-M`OLX`qHMV8|;wd9Tj*>D7fr$@9^wZoj+C;vqQ70vsx(XcH5;b z;KW(wvFq9)VEJP`i0cPFUXC00KBo^R@Vo5?5tM^G*)NwX#70r1wP2h}4~2()uhIuO z#BijIfR*1cl>FAvX13$PiML1jz@5K_Cn55?jVU2USM>}AYjc`d_WQ~bVGOY5n|d8j zcl}szyAelD>j^7DQMANa0&+6)?B8`aQL`=yBh3j~F|$12MG*&2^Dp%Vat}jxR$pIs zr!dL;chdaYOizqw;QFr>V$>`)%o&5b?@%wg^GLGa%pi2=3HiN`nRut19yj}5$*I1m zAD}K+t^63D)2+!lph%hC`~5D>Fu1VVz3bCU34FX)dAoV1T%em0`&`?)y2<_h)uv*G4Qno9=ZF)Gg>#WHI7QBN7CzW-RisMTt2z<$*tFCAj%t z97*)tUNswRok;jSkJ&xn4yv!l#rHS_&2ej>qA-eG@Z z?}_5cc|uR&=%zf&zZw~p>8BIs@72DH8o=y_&g+7^`hI=|O5HE{ z0y}Mx{whje-FP>hX?25F2v-zX3oYmru1m|Q@1%WI$ zvg`U`?3jAN?Sue~{rsEll&Wr@o}84ZqjWw6yFrL2;(aOBatq;Xj=H&0OJ&KB?OSCa zw+^M<_>h^YfdEF;R<#R~*B*<>`>mV{CW4mtbYX+M&%<}~cPamV{Ak^)E4F5?J;eyYdYx9~7s8NSb{Idpg z$^Q!f(m>}Q!gD`BZpJ?H7gp@ABs|zNz}vVIe(=c`K@ z%NTi=hK42Du_eZV*9YnMu7p5Bvlwxw*~6c>xqp{(6r=&?s|t**B~aM;M$z(d-N1!w z!;Hyqc6!LmUP+N@+EiospP46LaB~-N^n+>Enuqt*b*6^2SjV^ezPCWYbpa5h>rZ#9 zyqohq$2dK?P2uq35FvJvIA;Q)n&i7)P*vIA{55GWXfE6#kRCb-I$xc8)-JpHqIoH# zRIOw3>^cLhyFCeB&20Ju>>_)RE+2c;?V@^a-KeEa|yw?@{Bu9vE(UNv_i1K69&J zSVra<>I`>q@)?4&n+~ZxckSSJM!Gm%M${L$CZ6C?D45Mu)wqjIVu^nD@r-C(wC$^$ zq|R46$7wlB{*d_CSG68%=;@t{Z*JT~jkzIU?=_F+cZ*t+z`=$!t1I@+Yh zV&2vRUIXVfgsy*z7OYq=`J~?a31!=Yu9rY>ZKZQJo)>P0MLEb&!4og2bt6`QeJqTB z89Leyk#B#0Z5}TL_FbZSvil%dBk}{1Zcuk(G7uREzfIm7LNlW z!0W4XO8qj#rMElOV(WES%-ft^$TlthX!Ui9z2d`eah*8MO;59fGx&bA^)LNxP&1F| zA=jXHzM7_$a|_J|yzoIgp>yiSowhc@Z&t4P`-7_6NZ5>t2Zz+9*dI!R$OLN}rbcwk%54ziu*jld_|^p{?59H`fq3*0&gB;jqBct5=q zeAXxEV+qjfb$;(2dPm}q_5v>_^g7!Lwn!3YiZ8v6R@w>2WIU0l;W0S$cQ#+Y*CawT zbeoJsr;DOF940&yCJ|(21ut}7qX6~XSZps{p}%`G!V(3XA_Z!fnUJ{R>K z&~@dD+01$=kZV>~2w|_aefloEi4&Fq-4QteforcmOf!2u)U|>;k17vL3z(ww*!`Cw z)_ahc<|~&&n_@^z?S5PoZGEESCp%T^myw1qxGo=GW6%z58~*p&DthPO{+k3zqfRBc z#Y|yqIzq8^hcw$?6W+&c{B=WT$Qp-xZq{=itc`uWs0KaA2)Jue6ADa4rrFSklI=M9 ztm~JS=aq!`uPFhOicLa$;pmE^h*0o}bed9pkwRe155}O^+6DgA>iJ5o?N6ihyMcse zc4OmJzqLlI-pQ?Rs_)Z3CR%g)ZIlcqtFhQjf9l~eqjy)oqh!SURjvq3&Dhgu!xY#~yS+ewKHmxo){LD4mb_l9!ik@9C=1ruz__E9|Bmirq{#ro$pZP)*KK` zueBobbQCEzYh7QZDfib-3Dff}Hw6$ci3~+)+4x+_ccBWL+&TDt`G$^sW4OBI;CMiU z#LO3Y_+!tuB&G!#Zk#u?q)lCXXh`1Sy@xNA{d)9jkx%TX3!oL4rXQfo<ZZ!x zfLR+F7v))5PYk$_mvL404V)y?_{_70h+OY$L27%FeiEOS=C+B)qL$AP36%fhVUch) zx2V_&_(1oA?vLYute7T-B)Ol@=pgJO9$ZzB6tI~m5Nk#Fi=Plln5-Bi8S!o*@g3xh z#L~Do8*cy15*L?Ld130LXA_JK)v?w@-?YVobg6?GgBRmRIj#kCSkxYgp!TPE;bi<+ z#(AC3gi7!|3njpC0U`nA(-UC+nu{omOk-xmI6eb=#u@p%D$N#J>Nj zed(GMGbqV+Eofj-Pns+f9cJNuDk770 z{WY@E$}sUNpX8Ru^q5k{qmakN*#~CHoIoteK_Gv2_mRm&NwnkL$O_*2`PW4nBUYKF z>1@Xvz0TH!Df~wphniiacuac6Y{enq?cvpfk-b__?mk%KVXZ$kD?8dI+XV~g$dUa~ z5AO}=f_Aaf@H^5%P!yc9`VfAjwu?PkUY;kwK)u1G?;Z_eLwaU<^S7E(F`{1J+BbRw zaOy!7-(h05f1f;4ZRw+LsGtuLfV_`^-zq@kG1PDMEs6tGi6TUn6-by`xO;xK~#K)f(bP-+Ar*k30na;^5a zO(!%WLRdy7(tYJee8$Zohj62jTD>SSm|UqM(Ea`2B5epS3?`F7b_n$?clKyk4lqg?E&Olpd(4 z^5Dn4+1%e;iKX5M!CS5bwnsqh3c=^C|&sp zrV~57Bj_@M+SxcAn`6N1`uSNtP>FBf36X&AL?#znik|ziqQ|8iMV+8fyUTf>IF9U& z1GoAKZxw+f3NRZPN6p1>^W1d1aPvVaQyLG2$=1k^W(=V}Cj{@=TQIARnZEw(p=sM0 z`b}J-+pS~&mh_MBw@3a04A7efCIXnj5j#P;KlG~gCo|(S5&~j(1QSnZywb3T#RTFW zYCO%iVVDuY=f*MzHPGr5ikZu*L9JVqLS2|(e=#(rM)BT0ey?`DKYrqpu6 zvuZ<+G`hX{{;5^|BajQ>ADM-=6 zkZxa_q29~16F;AXTWW%Fm2K&xI7^_izx8*q4F_X@(pj+SM&MHVeuDHZe|uANf^FQu zMZ>-OWqoylJ9B2{rN6!YP!+!^x93)VK5yQd>GFELiW5@? zWKI#$_@}GC#WLLirzdxiVz?Sh$he2jm`c7sy8D~YB>I^XqWsQ|kI%<>)4M#@EmAEA z+y2YVWY`DEY75kWyAjH_hkEAFip_zYV*Bk~QD2cMCpSe)gEKkHwc-DE8Tyn2V55Mp zExU^zzl`YLnQ2;Hx)2zR3#1HQ(}K^Pz$@LKUgdBy)tMdqMl)`AthT`+6$@g01O|NY6D zJ|Fr&Vc@@6aV9NA;2i%a1RQz5nh(_q4u6vd8Rrz({7*a{3O`B1ujT)DAUQOQ{{I_< zYh+}kP_9O&Qmyx1svU*Hb_eVJ-!5E`ZejnRS`S*{+&J&wMsOy>@w{R%WTu#VP^T1h;=y&?46_J1~5EnlElFJQMK!JbYg2l{Yt zroZcUMgQH(iN3=RBPn{`N}fKh`%Ie(TiXYWAE~T-=Ijb&?m3imsS)Edx*xyQrxw86 zTz0)8;<8&SNOyX4ZeD4EuVwMx?ek2NjW*c`J|Z**y-sQJjNNR05bA+A_f&IywVv`d7>ZXSeE%#%Xl$1j?EDWp&j|qCgkEfh0D9PR zL)g5nUIMRnluw51eDEi~of+qpy=E#ELhm*qE=ToC$2MS((&968tDtDPBm43Nu!sIp zDT`R$?wIIvF#vX!M7C!B?mIeBjXV6!xY$X&WlCg@%+zH6z#JPty(zY>xey`S?la*x zsoAam@7-&Bnfa~W@(xdnm&sf5PmubpJbKlyPbqM@Ryo#xDP!}_<-wY`X5S9-IWKuH zPdLPAZzu}%f8Uih^hb*2 zoD9!f%Zi^fy1p3(SyZx*M70~=$cqre)wLaI%y9Jahlq_)O-1H}Yxb5uZ*bmOpS{Rk zc&dtz{4b#A06)fC?PhcuG(4xu1}8h|hhQ{<-G`<4FCDSD-1XM=Xetj8=Fv0>z(mMk zk88yzF4cnk=K0{&ewW!Qr^Xa&0gs8n0xHiOz}{qMDER9onPj)XcrZ!_hyTvqI2)DS zCrnb~!9uRN=6`o|f`7+G8z^4dz8`^OyR0O;uT-&s(Q1jd<93P%I;193Mr5R@WPRqE zh9g)RnU`-eD1}2~=RkPHUBNfCGmsrNhs*;(10V}oV@-U3NLKhJS{3mtUUq5~K%3Em zf`acrVJKa_^F8?8JRbqqk&f4H2*ts!xc6^P4m}D#5y(WdmT}N`-K>~`c*X__xSv2c z)eCrJoO=KM0GKfDwQ1fiPeX+K<9;QQ^+oNHy@pnk7cbit#rL4rIwU>^V>Bj#+Wf&C z_dya1>P>ys`9jHHm$uy`aseg`^0)T5e*Y0NLd@=)x{#~|br#DEc(Q+}!ctqiQ zK9jHzypc5MMkj-}V`(ldM{RW>$V)vPGKY8P)RN+{b2qFdD7&dhgDK||ebln75NS9g zgln-f@m14aT&LP%5KSKy)o_n=wzk|Z4Z+(g?^Xugr;SLuw0luEQt9$vNV(}5$e7Ow zjA|u#(zI>3*U)gdT+M9j`JclFDELw5MqfJ#@46=D^rQED%;qfxdsmOo%E2imGFab!#Hyz{iU7YSo!?kCSE{!S05i zT@48iBND$2Q5j{lF{DB4I|Ew6-a1ns0Bav$NLz!HJcOIL#RpOEYhHYpcBtcExXnOO&&tj$1#cMsQ=nK=XQ4 znBu#lzl~|o(4Rts3D)_V3?t>>^T8xQxbgG5K_+}_(VTB_czw^XfZVy~Oujj+58lfz zQe7qd0Y{u|p@gf$$`xd2;vlnvAr5;j9(ikLGJrY9c*P8FQyJ3LOt`8Fi19l<;v{$p&uEpTb)_LIW{XIAr(+xc0C({ zccrhY;~szv`@fv4^E*|85;Ioz;zR-Msp6**9H>IpLTKkxdQ>9C97(Q8LrX|&OA6~_ zZ*^pw!n5!LbqGuKd9A??c&<0&;*zScDL)Lf?k2dq7$c0*q@3%siD1_akT0vxAZRwf zM;ep?JT{u4(+HP7=s>l*zj{lKq#1o=D4X^LPW@)2Nn~_N@;W7}DkB^!jJAsPN|p#o-D)hhnr3a>@a7Ot ze7x0QJBvg#mQJ-Ima<40j2wiS&5(48xSdpscQ{=@nOc!LX@M z+nvw?4!ed97E*0^vv%^TkKSK1>4yd3yfWEu(gez|Lb28)=n@nNRbx)3o z%zF9le#Akcyh&1NsIx5!E`|}%@7$f*dP|TrWCcc=et}m-$KTiMhzU$)$Gd4qXPFPU zqSQKOCOqZZs+$aOy z|5`H~XoFExzv3T1G%iF50px86bCEdM&8W}P7FJ z&B-C`lVkgIeXJGV4;mL!$z-^5?g)0JaK@I_io!w8tP0U5Dd@gkQP&x$PFYKrd0O-Si;vR7M|& zC7<%^xy>A+tO+CuyYTdD4Kcs@W&`Z%tq(Fj>$hR{yT3krQzXy)8E3C0Ax0#A&Z^le z#`9K~_xpa{bNk@>O8F^E_-T<1qucu0`E4vlKap-Eeh30NGo;aT=o-^cVPpb2P*YG1scaNOIb*j?oc8Q-rK%- zJsxder2CG~y~Yz(fL!CpbPln|gA4}pP9G@uj4gKW=|Q#eXLVqB`^pNj<#6asR~3x< zFD5S%@+7Vd>OxDxssk>$l)HeShlzS~5s*^O> zzu{rW+1nHvsG+Yi>bI}JF4gXhFo4WWOGJaA+{Q7 z)5~fq#X%QUUurG};$po$*iF3Z9f*bR34}P{Hsl1WR5-%|jR7r%Y& zdV}PZp!qcvl6pR%aGQudRDpCH3&NFAu zddJMhuDyB~53Axe#liY>tO)$UV0!dcG~P*xkJ)QL7K@g!l==GC-_n!i~(>?K9kVeeSzMa@4I>g%~I2x;y_Hi|t;- zv$ogsM@@+?9_$&Tpy4FMWhEd(({-?@vF{$k-ts#uH+bgC_7d&d&(j1BawUvbd^8(L zBLa7)V)XfWf3|h&+}0#NDYJO?4&O|G8r;U(pe98hma2=A=Svz2bdad0qe}c37ZBSv zj4XyVuM~m6=<}XDViDXngCp&O-dRFOh?**9lN9^i$6S)$#k#Eo(V8VBJ~Pbrg5r*} zyV@FYnBQWj+C-eX#rRw~>D-s|dg-Wu`WttxB(q(L42^`VwN!Wd4T}nO(+Lf3^{Te+L9Z-y&_%&AYcayF& zwQDBifj71oN2+i~vwJZXn1&Iz7aLej{{t8Z(~>KTvc(Em(1!VN*bQLa}+G$>U7?9`MJ@S1^#F|#ik%T)D|uE8fuo4Qb=5% z9EMuLP*e=5t7STrg6qWKZ*oN15@Kv6)e2eIao3yL(VFAS8d6CI(;=}q-eXKi6Xg7= z`M^tlma2|7wa?N|N(cU!=NjL&A6MePHVJ)R)feFz*@`W8v9NuEEF5&6~ zL&(Magk3cn^wKxn)O71yiZ`U9ZI4l`fqGt!66RQ18h&6u$J>1K52}9lf=9*Lm zK)p;LqYMf{E;Z|z!P-pUk)^w^iQz$XV4OarXo@;|c>AuR9MxBivBr<5`nB>Qi7OP+ zL!GdPJgxWC;14i<4Ndt)Ct`S^G2E?;jHWT{s8K>u)s(;D0V&FYf!f^bOj8VmnAS;* zvK2$9tuj958)0Ro#~1wr2_Q^Pfjy{U3E2Q3NuU%3u}|#t>9Ax! z0K*7IF>Z@e1zH8@WY_7J@TnNsV)A~mB>3DR0(SLjv>jGEB#>r0E#o7#TL*mNZedJ{ z*J_DRhGCXHaJn$RtQOlZXZjZ6-1CA{&jphr?~@$c#B6Lod|+L9;Q^zpR&^Hd_@c$@ z^O;;DopeMtW1Kg}t=I}jya#jjsae4O6zu>n{3j2D%FTlw4C+d~!+_?G!cscy;2`PU zF+3sJP0L)bEQl_RiymnHaG9is{oOUlgWFz)INQ_TnT=xsQdC$Axj3%)LONf~b^=1! zS*ZwwQ6tAB@Icq=uaq6l6v5mM8|6O+xSk zw>XX<4#%FDYFuHfKTL=9%B!i5pX|+C)_ASqQzmEX8ETyQ0RA_A?vX8k`|(_Sieb|D|DF!|Li#7;(6@a}uo=s{?^t}sRlH=zwS z-T!f|I1Y<(jgOO3QL(}4?2QCW*ilJo({-bzr&+k(ry1_F{~`Q*C#wy+H*65Jw@a?3 znxv<}qu5=H{E!-&qqbu2OCYdhUE3!P#h)R(Ay&K89Dxng95N!~p&9=v=jxqf-h)ff z6EE`$a!m$|gFsYjtl?pJEIAFkCUDo3&zHl{LShvGkLHQGl?rs@VTv6Z5NQ!=peK!} zNcf#PG@;kp*?!m9s4csMZ_Nr&su|X(|pVkE^Yq6)gZBqf&Cf`wtOB`GT znEz_cmL*_|QQZSw6IW?6C221E8;e%_^XUq)J=dgRifbKIqYf_%5w%hvk`JI~e@mmR zquGFh#LxA}f@dejEhA^nYK0ccF$AMpa-ZYb#uynzhcfG{2I_BCqaNy&tYLW`*RI(^ z+%|88G|Y1=%0sTXY%+SEPouuGMOuKvad&Ga_)-bLqyae~UyUMjXxfiI`946FXeN_9pq}O6e_hcY2%9<-PL*i? zoO%WCu^To(OdnlqG{6m@qlVrwBWU?~^9up6XA^sZ_OV11WQ7} zd1WT!p`J_E0+|&0VcsLvzKt%Qb}cByyKOBhy1$CMALLg@8eW(Y+_4~R z*;&foahFpm*BKkVIz;`#V0#ZLg99`k&*s})Bz#gmI19f3cYth#x2QHFJuWgs3?WxC zB@oH>iDtwa8zw9>VML$;TS~_!2g8wX2lqf|p zx2rKixGM`AtnKEFBha5xhdR(5On#$?R^f!SB!D|k=j4#_RZHNhn_7h_pam6Q`c||< z;_TM~dTj`o=(obpPb&LaEyXHGT8w%8LlnyBx|pw4OflQ>Y7hoHtc2Wa8H3l-`9CEuQNM@^t}O>vsrXSf;5phVqK z?l#d-;~Wi+vCNJ_XiUhqYYjW-N^n1{M1Bv<- z6h~yZp~Q%AR(LF17R9#?;z*U>SsOoyk&h3Of)+A5WNC(MITjE|mKUz`ID;OD*e(Je zKpLBb3Z9d3cFUx>`J59HRS@T$Wp7k^Rs&m_Vv&9DLH0ru2?LCIC>asRG_ahN=-9(6U3vz$e~ ze7s32@hz>x3p1Mc#)vgNG@8?)p*wANEtdNyEH;cC z`*ukU=5OSFwMBmL`?;0~rt8-Ow8Onm>k3GwctG=ng}l=E0Cf$dQC>G@(SQYf+;kEV z()Thm{Q*0q%WerQRig<81*hHJQ+nAHDmoy-Fe=I}J-bIV`wdaEoJnL)H~PMyWoRCj z5cgufj(E1MRDA2vWRfe}hmghx_?ZC-gv~1}8VLC82!8KR6oj59Bz(3S1zdw8H3{He zo&7bd>cR8s?pTZYVv_IQzk5GS^oadc0-{jbJc__=ev7Tny%g684!-Ux@W^5 zse1+>!i{9%TGy-qWgS^B^(_qQdD1?NnYBRup%iem2~j3o8x>&Y^fP3&*} zAS~hk!ImwMokp)6)yJoWy6A5R_c`D+N|fYAW`O6y9xaG|_*=hbszSn`u`4PL#jw>i z7F4Pu;!}J*&i7lqo8n~Z@{Aypg1=Q%Cq5 zzG;iiF&K)?Rda>G)>bn7Svg#lIbZfymoqP?LMU`wKXfcx-jXm{EdNn1p+orY+dYwN z0G7uQsWBc#>bM!gr&O!NA;PQ^BaH zSZj1`_v{g|GSNu zyOdhXzA&W}$4_ijGY?#~3HiocOQoYIXw8<*P*A?mN*!YKmO;O3al7j&%HMC=wK1f2 zyJ|G$*Pv!OS6YLud0cU>63b!Y?BA(59BVbKlYybmWGXaOdEL0O%SW<+ACWMImc%T! zcCi6B8K>E&Ka0j_n2`I;xN3ry=h7afZ-gGi1+D3uw3-%U^E*q%l z1F6MIKb@-Gwv#736-||t#}f@yyZlxx~xJmzL#3@yGu(ysCmN93V) zWZ%qL^UQbGAL`{P@O@L3c4M+|GHYJGfdnk4dS{|B;A_rzWuNM$TIWK~pB8p@L>nMn zQdfYrcT4C__$+b|jWw~x=MhzZveV!3+a@8(vIkBmI4l+2X_WYFTMyGN?JARtP!3tu zb$qnQsnNL})TtwawYW#rr$4r=X`?)Xl156^@vB zD5AgxD~cQ@t6LJ_{A6!0zb7Ng`nm?OgmC?Jc$ejR#182*r8kYkN7|FCdnxOrFrPlew%3{S8!zEebz z_+7-G^ny+kI0xy?xEaBPp-|>^0ZJn^`V^8v_B|L**69biC}L${sclba|45p=b?!%? zoO}>W%-H9d;Jx<;52V67&f6WwxvOh2Bok&mt762fDkcNNY`wgllsNjkpBEro?7OCp5BDQ>7` zm~|uqc|pWTOWC^+jB*)uPR1b8as;sh4{Ci9I57t?rNMjpk~jW!E1@h(`0TWPEQrfn ztUGRwWem4+#(o^yX-Qvwpl`j#(E17^n$YFueornYJBW%ChR!}0Y229Uj^zPD?2j!E zze28t!FB!eTI~|xVx#Z1q%L};2WODk$TjIwRJKi1A+jx1jh&UchF7@`q3}l7r}*Zu z73qK}CTBKI=61h%?@55_tRIRjuJH3xoI(@eH_hjrJpajCEhhVNfLd}{iiL-1>yM=#3hD+>0{*-!nUa7C2Ye06ojh$=s6OM70E!i}|P)x0}~BFiTFUA0lL zm4dtEA4%2@8})T03);10*ZGe~NX3e#qyWYs>a~ccwZ7ZuB$xSN@xu`tX!)9L$?$m zZf!E5b1{Ix?wYwfQe^hFK8O^p07*}Y)%Q{KVTWCreLrMxF3e-)o~koFd<- zE4@q!<}+!`g?yn&JMG?{ANm*7^ zPW89cve+plzhV#-wJsL=CwlZA263v-1QKy*)+UoWfo&pPm)*MfT4jC^RkNqiR8xRk z@mpirVVGGr6qXqZPz1|c)Q~G|Pa%{6LP$p?$EYZph)xE^!SE1bs)W-h$RaeE13=71vvIkMdsbWREL<2G9HYnV8ZzWvJtKr33tjheAwA!K2 zDEyb5qBEU_=^jqFn$=exaGA2^^K4!KvYZ7)8o+zswOtGG7CJle2`!ozVATofTzMvu z1MjU-zbftkr=ztVhIQ|xc}Vir8qC2$S32e z#-}|XMoLXI<#v}e*;rxC8E@Lfq>Y17ziw;$-XvEd1f{D;4y`Dfy(apv22-3zGP81E zrjbr^w4DaK|1DTKIY013bu;e!;%oSLVxB1bYsX^bYQ}Gz91{c0Kt$XC?^%?(kodOc z;DU(m&ntLW!0n0CL@tLOc_mR0cF{#Jn5`yZmzf{zV2-7OU)F|S^bz5 z6l-f|)yOaTq~mRn%{W8Mt_7GhRF&OEAS=xTVNsB99ODqYwa`Mg^;B33A;rhFq_A`n(sLQk_281bIcRe&VG?kTd?&|GEQ zloKLU9|}9FeB>)+p^0R9}vxo@#D?1MF|@5{#J1;)h8%*^XWme2fAVi4ouBAVCa-f;48!Rrk7JEv+MsT+LA zjn+@gP-!I^{PGA6^-7%9s|N#gGIZ`$x`c$K6!0mjyCWMr%n2=8F-qd6icDh~R+<{( zZ4^ApIK1<7K{w4N`*@LUyr{{0Ox)q(OeE2|c0$^rW{Mhe1(ueWM5<1_<6$nS1FaLk zY0>FrFrY$Wc?a zx61IkcZwj1H(pnGtO4m=PnWt{@?fr5Ds3_dz}4ciEhNcI>*Q2J7NIj^=_eXMTAG@a z)B8zJe7esHUYvxz?{&E2 z#}qw(Up$wurh`c4AUf7-O{7?e{bgr1S&w&}9XpZ7Ly)eb?-!~z=JefeiB;#d3Z>ph z0lpUkd({CqM=SkZxXjldG$6*pMi@KSiC(YCH)(fqwG52)NH2$yGbTVvTqwDfts9D4 zlL0}O=$Sn|b^UB(;_+en+60QMJ4&?CQ++K6b@0Pd8zQEVe~zB+-2Fy}2D$4bJEol) zay4527WX=oaVK4eSC1_G3S79iX2a)d(C0jdlga>N;NykPo?GQRkFZ32lpoLt+My~^ z)h!@Q5(a9TJ)JZE1@f{eM*->7+ge+lm4FpN6duvLu3z21&p_9-^8(Ms)*DJpCQCru zJ$+k|w2F$enzZjgqoU~V4afln-Q|OQuSkSQ|AJSUAbtmz&mKa^hZUq zR?MBO=og*$qy*MFhJFruYN6hi*-$zQ=;f;S)+ zYFLQYtwBa11P@knX*q)Iz(>n*(%0f5_Z6ZpFI1AT}~a z?-W?oF0KIOY1b_KP1RAb+vu!0Q}ZuTG~|IEa))ju0XCJ6%C_qo^nQP8cPGi&Sxe6( zF42SvDOPKPpI%)vpui13MrAWqm3VzSPpj|uhs0xK@JW2=zE})({V2RTW zBb07CnEz~rqRQBqt1rjl$(k9&5vW+i9r9SGW?AQYBtfWE)*2f|22@*|)2$X$rT{@= zCS!qYn$R|?s>ut@hUbugM2)aFpm%AO+2Ft>`^1W+SmcU4JJh_w^hd?jFwFed77e_B zi4UkGfJXCdtbjYwgrU#+h2h(thh~pNR}sj*m4NAn-?>WgW-5{*iXw^ba2T@K1NZJm zHxSBZ3Z66!h-qP6=0##u%1ByCwkYzqQ+_SEDLuuYKNu6KG9?G87WuOLC*8}gm*Op9 znVH}BwfG+4XZL!j-(%3THNp^9sqf^nAJ)ZwH1iBM<9zv8%4_GMVP*19p9L4uCp8hq zRs9w`;5fJ9xZz2M!@5ba9q0|m9ABObraq9sA1ZMhW{w|Ol@9xLrSq>(cZ(AFAAbwv zh4^b|@CZbUNQ*gXanXfi@`YZjtB{jf@A@ZC&>&f3f$j-i8vsXB06VdHYGLFy5eQ7V`3BIFbCwp=1vK14s#KW4%Lz|9*&zGxx%Ydobb% zCg-DIJ<{2VhFHKP;$17ceb56E!*GkXp?@(cFjZ={DdkhCR2qczxI~Gp6R%&OG3Bp! z6ZecKl@~!L25Dx6!Bz8?V!RMie6n{VUxZ3*RS(MXhF?xf9XH8|On;eqB|Qa;O6pBl zA(+kg8&9!VtN)1T>e&stH_snYy^dCCk`{*kmRu~8bojv`ED^#L}ThUvHA1lSnY%bSvp`4H};p? zOS-RhA@MdPQDa@NO32?RS!0~T&+JTDG_eycd8KwFjJwcrJlRK+q`cmKeI?5EMJy5!#G-^JQy3SzG-)89Gh=iNb z>Xdlf08f81^nthx)9+< zNII2WZ?Fi$qSFeVeor#iFH1BE5P&3o7Bw5KaK0hobGMYYCLC#eJsgHg6Gpr)cRK27 zNjYpy@=~K~yeW6SjT}j)`V0Cnd^w`=Nc$pOUT_b>9LV&Xj+XcfwB*1<-i*>u`^1E% z?r&?tWzWJ;mlHQYQGG~`#Kq7r*`f_GpOYEQ3cGOcj-Vf(ZNo+95i#+JtO+&6^3;Ja zO6ByYvdsH@)`3`2S{U=Td+(d~L>>)V1u=z#{JRedM<0R4NO}7FLHaMaT%va4kjC*U7(5lpjol*oMG{B<|bJk zgUY8!hC4c`F2C9cP!h{eziCJw&*@r&2}DB9j^rSjHzH-Ma*EYVOtCro1nKFH7FD4; zjlQ3tIMpyRAcaT5WMw}TQ?-m%(e5`4uzqv?qCL@b)Izi5Taw|oTh1gxPd1xUM~a(t zUs8+l?YIG(P!&emRpgLMGDFxi-@KH-N8MhZ9~38gf$AdK3ypr#0tuY%-sZaV7+AL( zN!tf~8f8v3dfXoi_N+quPDiqAv_;-ew_}&J`DXf0S0oQ2Q8)G27J_!0ZJ6M=O=h`J zipu|@9;+K~#cK8mgBl}(r=G4Hdqs5_Z?Y9kDLICaK>x=pQ9%KBfSM7JEN1u^RkT>L zn(>EFkA(RZZN>hV9r6l)5Trvl#FmcUmtVrS@ITH75y{;P4alu+zk4aj`<( zc)nQfWa+my=wiFzKU|kgO^iPcVa5g{DOvx1|H(}tqk=|D}MN=9e5G1M>0Q5;n0 zf@vr5dZpl|sZ3TluOfN65d}ys@bVn9la2tR-CzD*GP#_oMgsS9Q~$oamFjo%>(FB- z)9XH0e{S7`HIzvYILc|8ZLx-ZPnc1KLDF6;$2srQ`7*JT?9!^H78dV;49~M53Zd+H+ns!d4M~r0+Sw?)6=KIiv?Myu7OaF_ zGhs-J|97FdK8%B)(6}YzfBd2&Ymrm?$jJ>Ic*lEJdy$d+Z9MSO)gzs9&jjlHJHUKG z3M1=qGcg$%8-1=(`PUeKjD+>3bX+Ec3}#JC*|=V=g$M;f=YdrPB``K`(^<&Lp$K?f zMgP&}%s#RU5H&4sTJg&OPVwhSqjj-n8eq-6IECtym99}15EXcIe+G2aQaCEA3`=FQlku7gYUq8 zfWldJm=ZOrWfZr(+z}YEiUfD5;(th^i{(GOlJl!XQ~aqX#laU9lQ_|jaQxR3EoZ3I zQeQdJC-@%&TIS4>Upz@BIw!LkrXGS1Lm8}vDx*^4}@g z7MYH~nVw{cm(R-(SauWQcxt)8l1&Apm0J4yjFY|?76Jowz*7GPHv;^-hVk%*GyLP> zgns`Vcu}2jI~n8uakXILV_p4sV9-<8EQui+8 z6j1;d7xZ2v^vs0qV3K~@%>XOK5V>{@U2nkqyw1s85WGOKrokOP4*O<|m&aRjE&aqO zV~s&c0M$4_i%%T@2K4#Ky$Zfr!6l!l`5=gI=R32gxGBHVUdBf@Hg@0CB+^FbNGK(C zP0|YhOLMm=M73b&QGlQ&#^E7rXF!@Eq!sHBY>5H^e@MWFp6*0Q6LS0a4NEm#U03YWHj5N#Z)(?(}p;XYLyZ zeb0l$pEe+CW%|`Al_gJ6hmt`<1mXO;U&5wB6GbHphs3y! z(>)Q3GD;R1==^tU^}+w4AA(~vKbNxWLJaJ_oECa zNqJ^6|B27n<+gumgQcU`A7(Vle*ZigGyNE~eU`1?m2EHU#Z~*BpRfweLGj zg>-R~-nmIFABwvV9Vs2x!4b@}?iJtK7a~9a$@+KQe*Tf(I(NMeZv#8e3+}2a`Uz4pAVaI5l)Vu5P1ihD?U~{@E(MOXNQ5k-B)BVmAe%IH36BoKkQm6 zjw9}_1B*?)WfD)BC9{+mz&kyOsp+rkS#e64lA-+_`?ywuzvG|_K`gs*dQvBN{sC8HcEfO&4IB0AKp19zpp1A|8+v}fHIGf2jt{` z%l4wNQ@}WN6U-55PXtx{3Z9J&I^>R9bctLg9&{0Ubfo|0+c#Vnu29AB!Koh&k41hj z77b7Gg(mJ8ZU_}=o(#YL;nwb3*FNU{zYV@5TwDDwsQvSB;Jsgh$QSz0pHC^9bVwXj zZ{2eIYjj_q;rmZ~T*?bgUe6se8IPv&WZ}RKC@WT7=mUQ}Q!E&i2=oBG&E^ShR?iW+ zV3C6LD!^CgechDEVkZl>v4Ez3orq~l3JQ~DDou#f3kYdP?D!C1;9i;`aLl`f z7oLX9!66aqpSh;*?_PawHT*&{Z``YZe`%?Ir+y%^(3JFAii0h>6CWr0FD4C8$qKz+ zWc-JB{GYw|6&Y2?_nV1is0;(uN1Xd>7`4 zZ9$U%0Sa7%qVeN)C%gZ7!~(8Pj7ValcZRUa79D!duSox}Ms>$+Bsaxgy<7(S$!tLw zcXC){<_p7r|M`HU|LV~Sj7z{s1?4t_Hfx3=qqkq7CQJwI+um*cG`~vcE)3Gw9vOzt zV4goMfC}~MAuvq2nUx?i+-PyY;dN&OlU|Wi{Q8U<`|x~0!GVyUO*Rkx0R45$dZ!lL zoBuG+|GghBv^f!9;d#Qyn%CF6>6;l5JD(?(o?~`#m2N8}(pb+n6xv*Av8A zgN(d;)u)XQ>@rXf8+y;|jUNLUuJ6OTdyJfJIpG4xukw_FzH1~|hV_^0zx?lJL}`Zw zOvvf!Z>PWWaVrX3$)zP{Zw^qo)f~pQ!)dh#q z0D{})ELgYQHBTXj-;%f0`((At$LnGDnD22TXq>+NBEGBx!3*Pd$tQg5_jVuA>KAjP z15&zmK*eT&f7sqKYRFrL-(W6JPJiWqiK?X=KEKByRf~F8)KM1Uu&*1JYD9B^PKZoG z1~+un@^G%!ASY*}Zdh%OezaG1x_`5HOsGq5z57Xqs?K&fjvoFi|JNAX0ka$gVUK30 zzk<+Rc<-#)FV4`^`VLIeATunoVo_frv-h0gm` z{?FFIi;>0x1BUhL+-EwymW}0CbYesjIIlKF)guDQgS+`iJsS-oh{qg>i z1gcUgLE?732tOQ8skk`+lf8Su+S~D2SuymwZMl*Oq`UF5g(cj@miVlqq}@yr&xOHHKl<9qqYTYo&r>9{?@n0vl-wmhZ(T>%0a(dAXq2p-l4&*v5AsJQq_PP|t2|ZdU4m@Mp`_ zao{E;?TDwq{vW}LGhzPq(BG@mg4Hma_SZSC#0ut^%om<;FaAO^{yj9jZY1z;uWJ1_ zd{^Si>ra5&C5?uyU4&IevT!3i$9^l=x4a?$6>pB3mT;bwVRRp1=}R9J z3~_bO|G0F&IYdouG@zxgDd~S?pz!;zdz&@CWs;YTAD75v*3)U*lu4$I2oC4$&c!E;LC#@e0VfPJy5#w~90OF3;Rr7g2O73;D0;&DbQsp8-LL7G8 z7~nF&zv%cce5NNt50XPY)w(@NBez5Yrbk8u>rE$rjU>l$0XslPlNpOJ+05|cF3Y-M zT8)-@9(PBUlH=eQ5tYs7^$w&mk6MiFAh@fgN*TTOLUm5+fszAHT2JArv6=QAfWEbV zihq(;lxW&`Yj@D>AZp!$_$tqli7_f4Mvx~6!QKu~x(z7y4#$lp`{bkYn&E*64Y2&$ zGJXjCx5QY#3Y%$m)?Q4a*N_D#8Jltq$GExB=&DT&hp7--9Pu*J4g09?a^~m1;14#w zqsm^Rp3{b7D-pu=IOfj3RD)mZ94|hpd~Wn^;c`5XY+RX6XS1?D|J_WjM8DS#7Qm;} zZmN8qxm&mE{_)9owGMc)T%CjGMK9b%9J&cLy(VSupvM~;{feRDmlo(2y5%2W3^?&J zhPn4LA};20VzPBNXY>XA@$%+(M5(e|gL103DOKuZH;u-Pm=%Z{jON0(*V}xS%z0*{~!EJSyOh=1*pot_~0VIh_!}0C@^Eu zZUxRTg*&EMu3ON&POa<{){*wh7t5yQ54eI!-V1PXM0LN0CxavF)lhp;y z3i~0Z^W_#|=Sz2>5#4%zG8^`9TcXIVL$m!Od{2X(kt?P9$d?;s1scNERtitvyYF*U zn32E>e1mQHwpKZf1`LlWAPlZ% zV4oa4F2r=A!Rm(=uuAdR5p~3ug2i*k>}ITc`3PTkYH6yzMT&>1ziu#Mk>fx1ddax% z`T<|<#Rq$K4LUGxxin8l#u8Ww1U%P7{=1F$MUF_Sbz1A@lqezx&x9F`@t*bAKAj#$ z?JwH-iB|lwo6Y^8mQ8yhbsUQ6O&x4E7{Kb!LcSk*v_lZ7&ma;h`lWxpWye!{F+N|M#PS=Sv|eI@(ju`Sub5_L#MY=CDLuz3B$?o z9>+ndLE+4Mcf&0vRU!2KyJ}_$C9ioeaYWdCJ4Um3odjMQ!;_gj>0FuVmjBnonLj0g zKyln`Q?UaT#Us41P1h@r#3Rr=5;XFtEv*c&Y2A%2MRdxmdW+Nbf-Mf3=?IY9qs)AZ{Bz2JMZ)6`@>tT;4w261cS9Jk2L2$N;UH< zv);+?&!Tf?A|a>{UwQooHUcR*&DQ*!w|a{WLOo#X0n69JR<-Wjg6VpS_za>Yj>8Hk zjz#Zpn+BMVEZBjEKGB08xOSyHaq?{JWdbJ0|DkqShI+QC1Q1FQ*kkCS@p6%%vfbXJxyC=cdNcCAU0HNkk;BEp6@NwhdUa5miY7mOhoyGwA@ zVqSJDoRB$Q!?>@oy*q;dp7FeR?bmAi5+8+9L&lq7vM4UW87gnIb>Oxm2QVz}a9;Pz zhPXS0>hU%HF_LzQ6}0g{sD#CykFUdde`FL2oSfZ| zQl%c=hK+&g(?RhiCh#r0&sH9cG>}$NF@Lj{;_Eitvi{Z9#Q1BeEqFYvAp8{*9=6Vnr_8 zf9M{CoS{|^B~;@v#FM5!2z0!#U>ld`Hf4~aoltvF<#Pnoan-|-J2%8_pC&|3yC z?r9c>P0iZ+rhNXAaW-Uc34TY==x5R88@v=>zDQ`^0zeAWCED#x;(>?V7WWO+g#OW$ zWHx8XOLv`xtDSLiCeFCHh_2%lYj@hA_KM2hxq6haHi?$UPe<+vK@?<`kwz~8u4hmg zJng0awp@-*AM$SkKCiQsDq>=BkUkw?coJuY?ARe!`j1{w4UQBtj7NNmh-v^?T(L zEz{F`gD*qdRh2zndD$hs$#pk*`h>%+$S@@&b-NrJ?AqWUC47jxwKos+cse${+YR`m zov}e0M~r%3VqV~o00gjg6S`dlHaEQC1leJP!)!yVN&MGxmi4g!#8|?Mps8pR%SlAC zw}iPcwA#7Ka3f3fjKBKy`3A!+Acf|$@7SQ>GkZ%v{}9A&Cp$2?5f_g)b})9#)##63F61i z@8;Y2GHWuj*X-GA&HvAuP$dN^jMv1kpFMkqA^k;M<=L~pHlICv-u?>tcMenw+v@kv zb7vJPv1jF@q`SX`7Z#u7KRtU^6@_+h^zyfi>i9*=`PnlZm%qQySIj9qo;`cYlNSH< z)kFVa`K2MA6v?->tD{&D$qV;}Rh4uxfV+DEU+u@Nm%fGX^6=dMd@yimP^ClQ7vSZV zkCln_wO`=hhYm-Z{Wy7BN*G{pi+%Ww^Bao~XWHtg6Z6Edyldshg$bqyh`M($Z^S`V z^Ao;9dJ1IsN_}v@`9bykl)P=k+-r*Np>5{WU0v_K615=B@j3}=Aa(v0_n!0o0=Uvx zN_>}IjEZQ-xhQq>^|Xp#DLd_=`9gq$&N$z!WsuS=@4W{yxu#}QJigqh_k2iB&}z78 zGlFemINue#rE0ghyGURIPEw4-sNI7Mwy({%bWZDK&)3iB(~~U74%Vk^RXs%lueX!# z{M0(L^zlWH$NDb4f$cqw5^RHyH{PDM>r*R2%X6NdUiF?p5epta>-52IY*DLuB-<~P_VX(1}-vd+nyu5PM6oOXmy_Ix6~mszP3}f%83)RdRD$x)?+HRP}qto zKCJ#JTgw|tGVMF_Hc#)KfZp}evMR)(Y%;flDp7SezqVuwf1^5TlqY#ouhuHzMy;=~ zmZ57QE#Z`DN+n2**x-w5>deZtOPQvmnU{>at4O?`jG~O6@vXJrU~A~n-gW#7XyMmA zM})mhc5G>Q-)xl6?O@~jT@}`OtJXvHrHRc~2EBwWV7=U)fll+}eW$xO=qJyj;Cp}T z!+j;PB+W<*&Rj$`bCl1=4xZ9Uh$h7# zuDo<0X|R*DgHrmEhP<=e*OH!CXi&V*-I&5Z9T`=KJm7aBAGtc8)kdi+EOLvdk&gZQ z+J&8O1msz6ggd+^O8QS81-``x>?dI4zq0fbN1k;!dOz*IRfLuIx@=~&w;XnNQXI2Q zh7mmPj$+$B{b^4+HW#w4m=KLc>YBEd=5Nb#1vNn>54+se4G}hxjr&gzib^v5FqL1_ zNE$~wH%4K?l+6xZj9RZR^hn9lAf^Uz1S4O(JuYnhU_@xRP+J7cQ$l^2 z&QvYH#J)$=$Y`Lff{m_?kV|56#g^H%5pBQZt>mD=i0fIc$7F>Ixvt zRSr0p(2kDNv8BnA$g4WuyAr7K-*Y4vqFCZ{&ON`du&{D*+~l=2i1w)oC!8cg((CHT zPVvS$-lDWsExyXJM_#4i)coTJ1q1l$FDZva_~~*SUQyieiqv0=D)C%pv`TjT@?TaW zg*17^>;&1}1xAoDe@#rGuwl7}H@H<^O`6?uS$~9CL1%pN5^eU23?QgznB-kU5)O)i zO`l1oa;0(KlGnaW#O-@1_GQXjp{6fYO8cS6VsY8S_exZ3BPha>!!#)MFECaWz zgf0Vot9`vts_R%D|b%gK5Ad9xyZKXmBy!?1lw0zc3I}f`eFGQdV1`IY%Na4UlT0V zg>fQ`DiolIa>g%715yv_;rk28`6JK}9|w^%Hi>!FwYe?3H<0~fBI19xdW7PX>enF0Eyz{qw;kv` z{|CAiupf8pc*$}Ejq2OTpz*BS#Ia~(;{ zAZ*}c#jr6#Of6Xr3Nwc)t7y8S%l7MX1IoP1%veXukh*?e!FalT0)uH~h>1dY)wV7B zXFJwZ_PE=Jln@#}p?ogAy4d<3sk1^+Ij$)JI3;zpJ0gdvmVBa!1S2$%{W*DI1RJ3i zcZ+L_G*_~_c8x~e7(4~l_y$KSLdJR6vqZ!Po4ZNjb*X$W2%jaq?AYkRE!gg%FdU^U zw7Q|Xf#yx^@LtSfrmtVq47)pLUDdcvqM30U*DQwOw4}}V7w30p^~o%gpXXewW=V4* zS5p)MtF_sRP>K>oo^7rR5ut%c{+b zMLK6~uXygX1HqU@4~+S9-D#WUvT*!x_d;H^)T0 zyzw$Om>;qaZPmfH9la(m-^ci(BBhm^_nyINlTc@D76P<3csX6GMKeT$%M+$*E&!x9 zVAK4cJNA?O8`FcPofy`85Qzb1N^C#vA1|G(~>0`P{L=2kC$e)e|2FRzLuy z)QpEhB9bqSmeZC_98GCuE)e*WuhC_?nsv=!2a@7YNnSIW7rOa{f=;Mt(cYBMcB=qu zuq|p*4`P}$XF{&D?W~nY=l*`h*G%XBY*|28*PygK+wm$a4|pEQRV*4G-6yCu+sZ_3 zz-y=Ty8K86^@f_2&&SFj*h}SYN%u1_)6yF|6Jji*^=e<4V2c%N1LtbRwI#xK)VtVs zwB4;Fa`)r4q|422@cakqOw6&w3Gf4(U0-st#n#!MXFpJ)*TN&4$ZRy4&R^j@TdHMp zybrON%#~ikdbQfW)@3>t)0KHUXDQK`U-$SaFTp`le{(*E)tj?~NLA1!$7d^Jn13Fm zENip6oANVLQcMDQ)ywTepD<^%LT%#XElGY7qjYK_Y`&TP4T%Zp8XcJ$6H~xDw$bTO z!8`BzPFEd1h8A%XmYVJ1WlbSH8QRaF!$i({+;Li9&vkso;=I_LsUj6xM5ouEw0PRIqYR@5z4nNVi@J(_|*BKZz?8&9(g@)WDCd zi@PM@%nRGMk0?_O{K3X$y#fupW6ln>bEc(1+1jMlS99aMn82-Lzd6pinHqby) z-dwMN>tgxcc1KT4Nv5k zD0Ld9QFka#1GI*JKVRjC$cTs@z1_kOePa%b8ub#@%tYNM709JAiWx)@LtIvMBhX3!?g zMp)_ONEJnR@3g(^!}S9owPdakRX_PZ{@5=vZmJ~E_joFIATAUH%CU$dx4uglN_tXP zDxa_%_vW<;bk$7rLgd0(bwRn0N$~!Z9t?UZmNhDS9>Ri6yB%VgXQ6Nch9&bvLCoy7mA?wkeSh$mEw*AgLYP1O zOuwcZ`R#Er0Isjir_(=_D)In)_AQGMS`rCtXH`#M2n(WERQm4B7%#0b^0^3PKL+EI-xBi?CD&WyVEs1K~j&pGf5^_LOO5!c9Mu|S7H*! z;tYOOEIN5jD+YiKh*)*`-Zvx1@ef&iE&3WWbVa&QM%s8g9e~qr{$`{>;=F31 ztcZsyWc%`U*eOQA+B+s6w15yJGzehcLoI_F9aN{%zk*pX?(qBsEzkD{Wt@ z(?{SOb*jd0pndI$t^SjrNNB`%$s;PQfp;+&bQK_!@;a`-34dul8`W)OY!Dz^n9711 z%A`iUv+27Rz9dUpAH|J?Ens+Oj1|&^6iH_ zA~-!J4i{BrM0CFRC%Z+?Dd?o=)1CULdQ<4lMwt5_E7g0v=t;BBm-i$X471ZQRHcD@ z1=K|CH;FFJwWB{}a+K737@W-9)*4yWNIG^lpczWKv(yzqHR-eKw#HB?@at*Ej0`!{ zq+W9qqO9LI$DsbRc7=3zbbM!n+^ev>_fAoXGeR6JAnN^A!ihLNh{+XTB0dKUV`hWt zDQUd=%wN4pKKC+vIDaH}7;2|~A;Mn0@$o~)JIVMT+9DE( z8xR$1WjD;n+jU$!>%76y)^AK63s6xr&sfuK-ElB%;GZRii0SV(?>7oczp`c|C%VRR z9utW2jEs)WHr)^j@(H>Y(;&6o6FtEUBSEVjT^e9f!n5mlS%_^#^>F|rd|39JJNN+g z@7Yfy4aO|FRBSCecMZ#ne|`h$sM<8NXS1?*0NO)#8Fmjxz@;>S3r@St4>B}$^k4qe z@ey#*UWTFdgK{gEnd$#-|H_Mc2~z5Msab-ZKdn(vJ$z)#^GT^OG}He#J_do;n8d=2H+^kn}XJQRo};n zs6Tzi(zFe$8%T7ARiIIB!I!=N&D?d3S5j7|{1?#WUUeHMj=lS@B$<;CCHyY{%)OGz zNqFA$pTUk}jrrd~8XW)M@)zXI|7b-%@J;vM^a{aEzQTW0kJ?mK z|Id91$I|{!d7S?a55)Ap!*&cRt)}|7?s3fjq?6G5pSslL$YkPzFbah&6NR^?0Dfb5 z#aQWf4tH3UlAOLuOudKg4vNu#_qJ>D4(SYQ{^+G>EOi-jL@$CtxdoR5OSjtn0cc)3 zs^~vz(&Q}qjk1fH_%_VS^w{Y5_W6gUpN0Yj7DMIU)rqBD+d5eYa$nd6F4F>^mH(np zd1^3W`>W^H(3Ur!uP(~jhM_~?3p3vi&0ckm+a zAHBW6rXL@_YcIA4ZE2%ZIS*Np3c3FH9PAz=e9JsTa@A*f3}*wi4UajGeK4FM!z2^v z?odV|s`8;gN%Ao}UPJm>g@bLJ?;T~8F5sMMBBi0a(3(`7B4X0wSK3y<>pb4_EiG7qf{R+KB)^!NR(c52vMRUQ9&9+}D4Rlm?SJ&m2F;CQxUgn0n#TVxn{TK1RC>FL4H zy%Yd;9)DQM@~zvuZ#^m&{)6Fjulg8`k%?mc9LbNLGJ8$jCvA?*X8mB_*Kg2NN-ed_ z?FBnKwnTFtS|lnKrG(xXY!w3+76Z|5WR-;!wSiESk2xLI6VZ%PMrZI5sWqxPBKK>K zrlwIW=PM}CORzl!O{HB^f%M?;Sgg4<@V#303yIg;c`h-w*4mk|FBz0_-_yz@QaMDr z6Ffqk74&JG0CdXP;)oZ2=EMp?gnG~hMXp*-{x=~0;~Yne@K)1$k5iUvz4o{0DLK$rNx*o<7&FnjX*qdyO3LzBvNbJ!Uk*N0vNeN1U0zO|&j%cHA<3Hg@W^Go^?y~#NcLwo-}Y%H;5h9foyX_Ee@H9m zF;gMDh0l?!6Z=Ql=ym5kHfj1W%kjR$`0fYmB~hE+eCPSDLG-~(I0JsTwfP-iQ!y%c z!99%f~7i8%}OGgfc}Rvbet-w0AxDq?%$ML$lQWOww;!m($ri^(v;=~Ki`G& zd7k0f5}oL>5f!&IgH@DF_Lq31AYGQphwKV0%begdiU#!SKi~ z5x%x)z9$!|w@(}yNOw_y+XIm>?RwQ_Io!@3fs866)^;k*iWLVsdW8@l!zW8!eyKIN zm-DH)?7^ey>*HAwxe%VzA9a!?8-JL%U9b`M^QP^R(DO3?G<8~zZSEf6q@Yoi<_QAP zJ2Enoc?QfJ|KRFH&Xqd!-C%EVO5ept-miK#rMLV?G3Pe&<&b)&GLw|;uQ9U5W;MeJT&B9iy0`faUljU6jw{QpMl6WkjUfxe z3lvOH0UUW$0$wLJbW<5U2kZPf+}kZ>#1&Jv8~5`3m%-MV6sHN9<%@=aqm+nr7`c%e zVD5V+YHp00H;nH;jkN!-v-z3t(N+2Oopi!G> zl*rA+{oXjzerOVsJoTaT?n0(7mpczaP1QPdb=GRpD$%vSpdKQ9y?g3`ztgcu$;9n* z7}_~T8&}hO;2nusVW{{$*m#Mk7);sUoFt6&TGd&az4UQo+CC9DG?8c59~-Pryr7}l zP)dwByYOoldxmh154-L7qTAaeq%3DVrx1RWDXggMVS2O$!uYA}f%X-@fQp?)VA-dQset7mLJLB;JL=$n2=w5z38`{Nf=W7ttvfY^x3RK?;=AzcfMYEeu!Xrdp=ahgOm6X(rsL|zMcNFIMhfKW%xtA zOqj*YyLiQnlmbtj-KSES-l1A!b}@<@=hJ&4)|Va}PTQWSZfq*in8k1-H|FC#DZXTPys8Bja64PVYLd z(_U5%iKd&tG`x*cRMjayle#Ns;^$O_C8SO-&$bx4xP0Ajf*wn#HF<=MWPAE1YcsR0 zOzKd@Q7HbvGJaztp=EHIEyh}X0#}G1jSVs#tW}-alrF`hb9JnG=;7fIF2OW4-A_RY zASb!(Y_;~@3$d?yAyj+$X9+slQh+_@Nfhnp*!uod>-CR0d)%z8{aqIs#~Y^rTNQA7 zHYjSaR9$@dG92ey8-5uMjJt_WCNXeHlVU3>T{V|@G%o^&5&+>iE4-oxBs$nIUf zAaWkgJX`v1LLd#U2)A79T?xRxoAR+GFfe-^s>EjW@>ulqi`r;VI+gc|=Y2Vg{Mu@e z|1Fm=ZOBwnUVTR&IBC_UjGfRp;nz~;35Wdiuu$~wHA9C>1{zw~#9BX@Xd3krPPG~kNv1B+hw$~AzBzKb(mg_m7!gVxX!y1ZtaKA*ycJJ)q2ghwUSjn30BtW(&f&b z6AL{vXLn_oWt@=x2m8d40kIM+_^%#>#DzM}hkT{9_Ifafy!?H(z<@S}tI)%%Xt zcCd2c16C=lDguKPG`iyQk}3kpLO_tL~y-X zDB?x!u6fVPlX{RN3I*RZZvhQFhPZQ7!9feSt=QE-n|$Yj&7FVhd{u6X8~kd4H@?595uO6T9b84lz?-#EFzj zagFoQ+q+=Z#2htl?pHcks!4Guh8s<=B=gnh><|a4oH%fWiKc|D4&XNX@_)B$ajUZR z)|fPR_#Dt9(Zu%k%cl;P3AqQW!uhvp3$5qGYV_qlb$5_;C-F>nZ!c}3?J-pkgFnaA zQh|e%f6VFwr+DMvP~+=94B_bVU@F8Gk*D5cU2D1cHi@Hb!QC-?XK(n&auU%z2Pc`e zdY1aK$n^|KZxaTt_zu&KkmHxM*KI7fDoq{*oq~Z;i?%a-ac?PfaczBgVbi&_a~4M& z8;n!Un;U(SGnVuAlz9R^eHIEb2bO3`X>yArJH7lnT32YuER9{2Ma~0YCe%o43znkE z{I0pK$7!q0yE0&pyI8qF-+&6ux2H3ZY{r_VVlswNPn$iHcS(LnKcvJR zOLcUEQEezb%dUan<;m)u;A6pbu7>(2oG*4IHfuk*3aXavcC~9cpZ96R?LTs)Y7~i= zIq;5KJ$k>+t$MjRATwLwNJVxD^cy%|T!tuatbR}H?{93yg9uubMLiYy*M4zN%8#&C z$}>j76#r^^Gzy+h)4W_^_!83zovjhur>Y+UZJbIobXquA)GZW??-5N_ZZuRB>ee$( zk(--#?e)he=hoDEgbDQM~PkAl@IQ3rd#`LvO~<3rhbG0v7<1 zvwdSNG1fNgr-PMgTlR2n8@EdLed4`qvo+trM6TOze?U*SuU!bk!j?Z;FaFy&Y+2oV zDEObA@!pGu4}H`1lDJ)>eI-;EetXHJTyG?sEsL=|d)egujeV~L-!obI&im%{E)fxc z1qyc1R-si?>iNSC^}i@zsyg7maGs4Q`af(1kOt{Y@kijQ)YU6*94iMuzfOPhlU3!AM$SnL!Tz1Zf*2w?M;tVA&$exsekzvP847` z;M|w|+n(ad#YeJyf~ann&aBb2r>Cb+Xl6Hhp5nMuNWQ;%b#F$m{@B|MFwttc;*&y@ zo9)$RUMCzOfh5V;5^wI8~my6ASj7+nzI6(sur_BqK z$w}^MwgfO6{h@M8@3O995owCm)v{NeaOO&n*3Hl`wG^K(f_O$%?AIyT3-OM&OPK0- z1tBLUN|^7xm2&B`1mLhr@Dw93UeW}uzs#L*zLKiR>26IUn_P!=KJ51Mn0=Oh)6(Wh zQqqBzh{ZynA-CQitMnUyGX6G73B4W45ABW{S+^O&Iasm~W`+G@cyzrt?jD|EcXx%g zYWtP7ql+qUu4E2=8dvnoXv zbLw+Rr`19E*SriR3UCQx(uBq(7Z3=m+r8R0*U7&UO3&wd`bq<7L)@6AB`V!~Kg(wD zS-py98B%Ds2DEhdX15g$hCwQhNRIeAp!eNy>gD~Jnvt60+xEQ~f5w+o3ylxy9RJW$ zlYWsif2$Fza=5WLjG+28J8pdTJeHSuqyoP*T+{2T__m$q`ToZsc|ECw_)3czadL41 zkrJxx`<<-#$`+s(z-U>VRV!;Wc`KZBKFPuSV6A)DfoQy>dB=pJCTiK_aq@F?9ZQCD zb4iydoKgf3KVjW{zq!prKCI1yiulRWa zMy&%ZGoc`1^??TJ{vt~QSrn4WDq2>cI|n0NDGvC56;yuytwXeQce(VCiz#$e*cMus z1eCq~!Gm0*60u}leHqX*%gU1#0yU7$nWgytH8kPFBHidSiN%K~=Iooh#1YK{hpf*} zNA;0xN|HzYZ07{AqIn$TXvjG@U;P(s(@;>_(ysR(7jM^3r$)7b&rqUBx4T2*Y@yYW z>per&cL(f=k4tZ(Ru89{Rb$USs~11W{NuXd{RBup9;I(NC)RbqLW1~%30Yzblh#_? z&803S83g4c1x~@f7q-d?c2PfF{Eu=SL2ALF5u9O_3qNppqyj{HDkL?k!?sabh9OF|3Z^+Xf0+GDm>x&TxG$y~f230wxC4j{Z>kT#6*$`b#JwvdP4q9M9 zHgs(TnzN;gm*}WG!i5wkAyVXiWh0$&*{h*Sw$4&B3d)H}z z>rHjlZAP7mfm5+On@mChR|-c$pM3XL>cQnaUp`6Ty$XBz9Is{ZW9NlP9>B{hDwlSD zs@3J)Ac5N8Qb&axc9{D60G!dWR?@-7S#XW}A%}W}u9*0CdF{buQg8Y9QvJFxTA;%u zVEQd4dQmne)4$4?)P-s8{}-0`s*`>4x?+Bdwz9I)*u zVw&P#^Z1DIxtBGDcJoO(=mSTh<;eIcXHlj+^2VR1Eqxpz@!Lx{Ow#9^kF%ri&i{0&CxiC&q-|l6a#EpN+`mJ+ruA<4EH^&8 zu(#^h?$`2#IMCAz%g{%t7a$7eKt_i?jJ3_zfSsNX6#B^&u2-*W%!duncI-_@RU!vC zE!csNlBJ2SFb_l?uuSEQ`C5)?`VbWK{TKHB@bi{P9NWj*zs~0G=r!9fi+{%`&HuC^ z6(Tcq0BVpnwpw6aJ(+hC`dkq*x#_B=MHq`AQbZJI;5>-6jXPwIOS+RM^2vh@6f!)XkMS$!(@pQL_?l}8nDMRGAe>a z^3+Pyhtv7vmYSSvd>_0JN6WGsy%ExJbQmPO_FwPh)A`ujye>OUIgHfEYm=ixYBR*q z+f5c|$nzaO&Yh)%a%+vZG&=*Y@OWODe*jq0Vxns?8sfqHD$ z@2kjmaLi~=hMz~?p~ML}^DM3Z5QhL!J+g7n*U`*5y$A@xjh>V8JI32Qj{=-YORMmb z_4>WD{F(?|SkN+kbAgDTb3PjxB-k2K&B~=mQI^m-U@rSyd1(@b4>=oyW^0lOlpj517h%jYF zD%)ndhszjnQ^mEQEmrQA>O#`?zh@D4lAByA1h%x%O*C;@02EV6+k`dVkgqC6zx$E1 zuaJFN{|0+MJSmM@@fb#>ZCa|px~x!-aFxdO3e4Mgdt)RmlWJ;j+)r3kiTr$uFeMeYCTP<67IpHvc{Nsuc4f5Qk@f5d6?17aTK6u* z28-KNF71nWa@4%JK_Wde)+F5(j*n!OS(_$esKHSo^*IFrS^h6HW>{s~msnA#Bpo~LPfACo zqtQy$$BVBBbPN<&4IFuW&p=^w+_I+RuP%V^OdnrcAMsCK?*J6jo-2+ZsaLEFKNt$9 zOw!hmMRj%$Z1hQ|b8ur0BG-yLt#|sU(4DWXgu2=a?<4@RH0oTi zN?s_DeT~;CEe`nb&nc%fs;n#YK-%)$MbUDXL55eq(;ql-P^l^o?IHYur`qameY&d5&p2Z1&;_BmdqwHlRa zyZPi^j6IdJnnBxklg=*opyO1o9PvP6F01L}{5rlEPOa)2IabLBDSbWTgbl*FYt36 z*Xh!v-t6uh1vJvE&n8xdFS?G+RxCH=`4`T631N!7t%|g+q1Jp68QkqgT!U}2DPhe; zL3xYQ5moa2v<$M<-{xFvvlIxGq-O;$4F#RTrfdeEyXq!NL3buC=w@F4hf>V^3zY!x zvB~vG)9!>fX7!Y(qDIJAQ!Cbww!>~7J==+@UPa+CXx;38#6<3?+AYy$ZfAD-vDR_G z?4LB&?FMiRq*3W&;4oOAFnr5L4) z*5@waygV_MH%#3(i|`89YR1vqyxI-LJR`r7TIpWQn>y5kxQbBos2_{wnIfjfnS!-;Sr{j{|Dj-B}V1oW)6q``cCFtGj0H#7*d9cmrBI#iA%;l(xt3 zwSC)?EuBf-JG%@t;bCMO0w0XVkbXpt&rSBlUnXB~TA9xyQNl=jd{gTPStKd9%RZ7t zBKJ61TWc(i34;7fIJE)fuU=!~5IH!=!Qtb3ePzi@JynIAxMU{cxDVg59;C402?5Sb zQXH3-oh*mH_SOv8kK@bYANGomiCT_$I_{*-w{nrXk;(G3(=lR zfRAPf4rB@o!hEjCgn@|euCC9Aa5IIY72TAjAUrG17)}cXj(mBAzFpo^C->eF{xF!= z#kOuf<`Oy@J@WOxp?D#WNXxM zPp!*W3$D??95KN3<_Pg8f3^chv5(3*w-qKW4dw&(D$eoG0_$>LRW^DJ;mnXuGyTU4@J; z(wd%$!pg#5iG5Fy8Odp zJ>6wbB{)*lJNWV1?T4HI2Y&g-it>p5#A|_^;L`Qprj2xO$BdbrUZ;n%=Zm%W@^>OR zd@jfDt}wxyD$yyvq8FVh=l4{9t=PbS2N|q!C!&*pq>egG$8<93B1&Q=`W8g=u!l)X z@yf@)2_)>Fob%#qi8zyJS6p}}a@;Re>oz_{w-Eej^fhK`H>k~az4<|E!14Vdm=&N| z3U)?Gs&N@&NQ}@G+o*Cb(rCiYo1%RSoe;rRdo#4Hp98PVG=?229yDKyhdtwVeq_9G zPzNQ7y3v`!BMFYU`<1(+NMR z-)V=n{1!xVe@e^GqVE>X=c1|&!i{I=sG9(Ap5RD|t<4|DTE1N$i>LE;Cu(@=S}t;v zMHslDGdV^Tk(TA;TY&ILW@Dea3WK;~xNlFD70A=r6(q~}#V%M{ zhfSd>&$@!Je?1v;4({BWzr{bUb(l zMWJ2^t|+FRj9dswM*FTzhPfVtY1>f3j?yf1o77mx@-D*1PfVj67s?!IbH@r;3le?s zC6UwqapT%AbfhmjmQ`Z0z=J@sf6)^CP-A`JpbJ7g*$m~d=!DiQs{Qfq4@KW}i`>@X zaH$jyv-wIRq~9(*N2|tMTwHwq&clAO*2=o*CR+kjsMAnR+)aXBQ4ww(f=;c|SG3gR zo5E=^>UeWYMpr-bYl@I_kJdyD!POHVPZvexr>bf9P8So&LrpqtoV@X&76`!{wNzIMP^~7B9 zWAo2);W%s*>}P4+0wge!*OLC z-%3Dn&8iINBn%u%H#YTIQhjc6P}fZM5z(Bk=D7QcR;IQgczzd~;Iz^DA;}Xhw{Mfw z)02tgX=(0Yv-`rfq#G2s-&h~L3Rn|pwig|0$Rpj+ zpN(3n88r+6LjYe|LxR?U^3nQlpIJ^5F2 z;~u^Zo76y|h#d94ik;~y0x2Ya%j5;I(gAA&NR_3_DZZFXu8S*vSLkl&hWyrAAVH)h zX@;X;W9)sC_V0sA?(Mr1;ikrk7*# zz(EV*`~g(HjBfm}Kv@s-9ZJhAl^k7)T;~Q|g7b9E4ZqKzbFSlFgEh zlMzD0H7FsI%aB)i^f$Bz1%B2E389tL!=}I~>G|^Y>+m@l%$iO>hS`77mP*F-TWbwSu0LW#m(vpP zX8-aa5Y4*cRGd_%-ydk4VPLwqCm8=EB&xQbXL1@Z@#6N_OwE=`L=jHIp~@~E@{8YM zfrB&y!8u3OIo|{bEj--uXEC2%k_qRl#F4{z#_mT>pj^d6@91< zvcxWw62+hg?oPfqSQ%DjbI86&YP`A@kku%s(`j29CjXkqsX%n}7S*7L;_EWHpq${VQyPJ9F*&?S)#lRS@38tcm6$Tc7pAgAU5OC|A>lmAHGsEnEXxr*F}w}#Wbaf0f~sUL z$?6Qy*p2V&&1>fUa;id>GT8+JT8zQk^X}-rcG@xXr0;G)Jp)r2wpN^PoF3jcbWxwa zIrlv8);~g#Tusg4YOWz^Dsz^^CGWV|pPQ)?flH>1T3rhPfyGbrTJl9Rltj+GW$=kD zdE1GC?ek6P)7fSCc#)w($b(Ve77APD0W)1y`N6(CS6??_2*^uD2GW{~oe~U8!oszz zJ%k+s@v@zId|k*Er0pt{1%;t+L6_0FiR}@wardbW zRFB!1*!U(RR#oVjdb^@+IKdUoBf8>6%4aP0)5=U#5Ikn=io78^R*BVsOAvGU*A&!W z7Kmx$R*i!T5d}F1sI>bvr=vD9nth|o!@g=)0 zV7R(_DVeO#NK;*Dxn<_dXH}x_xjydN?BHj6jHo8;ErkSoy~LSA&O<&2ZQMGjzGi>A zkk61QO3KNh=5<&xJza;-&{Ug`46b(gGw3#cxI+k6fYbP$&8?>kzfV}Az0jvL|0Qi< zwx11Hl2-#onoZ&o*?inz9lj*PT{z)GGjJ{H8R^*|@}vBH252vKk~1DGFb&TJq9MDo zj;_b#NUK)xf-RhS*$+6nwkdwPrn%*wjAOfa3W5}NcIHa3fxaYzUCc9t3k57MU*l2w z7kp>BD$SLLvmlE6cxe2fX#!yEeTn1P^lb1}<#DC)XMQ>=hYnl5Ffy%@%lwaPf7KSI zfp#|vYObcuoDz%Vy}AJ-VrvS6df7WQP7&kI+B#h?<1LUA?I~iQyJMHrO7xas5*l`%sVp<&!)Z#d`Wh>C zi#7CU@vV6&TD}^j*K{m8qPE?Bvt%Y9b%BbI+wFNDg}73c6L(A~->>PHLye?q;Re2Y zK^8v@=}cmbmxLRCsO>kzw21-32>L%Q=IZB;C4o&@iDL<@KIYHs$z`-ePAz`rVmL}# z{T6B5;}F+$LKD5e)*gPH#YrA%9up%g{`f;{hJ=iXyL@1UR#gk)Nk971M&-)_!VObF zayC5U*R4sC72gR#SpL~h@0`>Ft|hKNO00g6A@YRes{kb?S|TTClHwFz|$C%45G;z_&*L!RZe7X~RFC~va~ zi{*!nTo->L?u|?t?Ep2rSIQSC5&|zr7M-1jn?KTVP6bb^A{|cC66f#>Bm|=P?_8aK z;kap3IRh~>r+q;ET+CLeR`kaA#_8ms&TJ5{86WUhVD(SjzO>$nU>S_mbq^pCNZpPW z@VMx$PZ>3zgu4+Zgdxyy;8LWfRECJnH#JcSEVt5Ue*pZp&w32zj-yzitn^ySYNypu-zBzee@>&rm6xYb|SlY8@p96_K+JH2if3%K>8aJyc`n_K zF(rXNn8Qela-imV)#>W_VbaouO5=CJ8swT!pA$_LN}+BkRRvT7i4(!yk;wI=uT3{* zD7Qg3!|5#S?d!R~vtcsdm4|4gC<)ux(>%jX+^VY`S}p_mbO*AfTE-Z5RQv5)q`@2{ zED901%e|RHhQcVprFy&H+X_pRI`y`QuhV;sgK?V1#`@=~L5+nTVLyw`;YITrPT0JX zYIJ;5Z!NG4W-k?F_oui~mqY`1;-+p|ZRzjj1puFLiBNp#%nuf1bL9Sys%RJ(9N$V_3l~|jIsltS?rKR>4rgjxh-uf+}@-lt^ z?UkUY9r6b6!xeoG^?5LRVT?7ziA|uU2jt(?AK|S;D_Grg=DDzV4W_%<196j&SbKiS zC>+z1a`+M4`V531rSw|@qE@QUuCN$uQv)peo*L6PRyrYRagFzProKfn9ciyoi_4Gf zk}5~R#Ygu72d! zA)w|!%bVULz?5m`ztJ8O<&1ks%ks$gR^x%61g3*V^f}I_M-gN+g<0c#jQO7CB;ViM zfS_>^1o5=aeCB47lWH}j-ifRNIAp7v4>dwNf6rM)M;l)!()8OGm6<6&gJqZV4U;8k zd}_w=?s)upc7O#RGjC9JyPNevWRt?nbt7E~YW`4`gSBa-c{MwK>x9IlQF&BAYK(Hu zD87K}fb{PMG67hKjR>{4um1IHc?_#)r&6II2{v}_ z%2d+W&{OMQYjl2UX504kp~O57#K_8NcHZugC2cTpm~etfZVPkCY0Bbs-$y>3CrT#9 zqGI=!#M;b}rgLo=)v0%kFOrhIvQkJvEl``&k219xG&hH*f@ReKF$(|afg#`YPJh1E zi5ysPh7+iy@3k1r!VgD-vfUFb zDtj8YXc0y-+o933k;)O3f3JC2#1H_Ki54-&q1@!v%bhNPA+M4e18O`RM1HaXSmiy5 z_lY+WeMScLU%sp0$V!u2AUNhZh?)3XZwR?x=Ug1+(bauun&8T&JSp?kuy5_GSVnCi z#_1A|2|_MxElimXcW%Vk#C#3Mk9~*oQRU{R3(l)hX9C|c!y*GK4sV5h`EWYBqyde0 zbcqk3m~pCFB>stpby%`jL97=LL*+zOrHHV(xoM)H0C(PrhLW{%scP>W=t|{%o3pxJcMCv$d)ZYV^JK1sh+ z)h;Bwi&C4%diqC}2xIHlMv8{LqbsPWSX&Y-iZS)#=&+qdzfyKf;p)+ff|SSNQ#`%# z14!YXZ7*6SOa8=S+G2$m;gcF2pz6K4$7`WiL_kMcKoi~C z6af+>`NL3%X%ittMK>YQ@YE9`aBiz^OmjmO>lR^pvLo1SrT{{MCx{dZZw^WC<$+4^ zqqE}2@kxV5r^qG2A?5nkdaJDGt#Fr>tbPp+C-FefjvMM`->l+jwNiJO%P#O-Y^S z&W0|CI2F=5cPlPdL{m5M*q2S@)x0oGN@|ueNBDxZO(UC2Qg>n5WzrV`-0DX+A5AOO zkW;oBR3iz;OBXR8PUIEQr%qFTzjWT=E<{Zi$ti?-68BdRzx{$;$v^M6YG&$fdm{;5Q@dzfv)k5+h`PsG|2LU3>l7Hba? z^X}ezJPXJ&hypvKbLwz zQI+P43O5=^=;KnaM;Y`*9-Wc2{&NoZESQm61u5EHiN~mOe$0XR%_JLt*gyCh{gM~P z9nA7U{pijvPYJxoa+bHxn?4XcYDMpzquvd<8j|oJl}4s`UhrF|2fHr)jTPaylGGq? zqz)~V{@Osh!#untk^0r{vF?b)=6ZEqY%u4RKj~vQC>_8!PC<))PZwfe7Z}Z&O)CO| zIJ`(~@=(Lh6Au0`#tMFoo89eGJ&;KmsVf0HPFl1C?!Ty?X8)7GBPBI)Ms6leEKIz+ zTNI5*N2L-!$?0DDWCTzmN{Vh+Ki>bUXeeEKa12cWs`XnnpHJR$`BNuQp1ZnrYnIaj zaCli(LpoW(v`{>LSK%P1X1gN~iX@ zX>asJ3<}eKo`rMVKmI3BnDY|Ex8Ua&f4z#6Ss*NV?<4!=IpGyGnb56HZnz+O#-Dzn zD2_Ue6g>&cQ?WR+{v+nSF*TaXMyV;`)%xKrm;S|1DKP2W!@u~J9MoTF%EA{ae^+Q) zf4A!d>)q38YqgvRc%^xN#m)^gx=i+a(DtbprKFiLZ6@C?XA?2IRq-RHKkHPn1}1g~y2#Qd}ruZng&MkFeY^2V6YVV8L| z?B9g<%csvGX^Mkhp}C@B@LQxrj25g2PK<*q_w;D|qT6|KyS3{pE9H}lmDEcs7r0tP zsg|lj1ER1?Y$v+Xyrqh`M?ufAXD7pl;)T`lJBzf5eNI*Zznzf;$<}?1;o$fWLX9_5 z-Q&&dSn|hThYg{n|KU=}mFx~4CtqQnXCX7mmn2@76XE+mRKA7%huD6zwMn3277lBB zGU>0}YJ*$7pf29M#_hMSyU|+7cv6*BculHv_$F_s#}AOn#zYEJGxlH$vs;LKeBwJ$ z+A1PCI@*`xc{e_fG^bt?2athphwot;=@xs>!6mI$S-va)a~7eY zXs_`fLL@TVLI(0WE@@H5z7ZnWFxW&&bp%O^)Tu41w$ts~U3r#Rg>thFXrCT(==a+y zL8_6|*pf1x>*J=ctHd`+UL5|(A26MKU$}9C1yqF^)3OoDsxOs^5Ku)-A6gL=mpGK5 zqeCQTI!PQaMBoz%cKZk7I?-`uVK8CTFC%ANhhLyze>U24^7Qf~+rD(ie$nKK#uhxm zm)8OzJiGGyCX2|`K29f<2|gP(A(X7;AT(?6xu^*Thw}-3FVV-17Oi%}oN*3^g%7SF z9{A1AC`K|uXKh!Br>OA2TLUbV2q4oOsY2V7hUX|h>kc`doQnO$y~Mcrl$pj|FuVOB z@rDX5b-FZUZx;im_@VN`n~VG6ZjKc7Dl1%*lAd*@w0RQd4I4qDtle48*Ku{DnU)Q$ z4v5dPN^kX3`4=^m6FHogonZFyuJ8Nlz1-5J!bm5NHlm1QDmS@OftEQ=&2VpQ?>=Aa z4N9iv87iAnxdBe{mdkc0CgUnMwBrD3rB$;tgQU(Q508l|`RC4N2r~TG3I2#cfj>VO zX^14q;V#YgcJ^@|D&huO|1 zN@}08ScxMDkO0}AOIAE1CPntOrrA;DtaEZR(~+tpgq8bh&u_&)-QE?AoX@ZbD%2RV z%(x76oZHsB({a2-4Uo)R12g^Di;eieXdhGdjUzPo%FH*IXliI(-oc#dSf3rW zRF&Q7n3$c0QInDj*@mW0GFWZc&?#8g?Hxb%}u`h>a zsD)9J0Ud^Pu;NS$P~d1;+`m3x`zEiXG-_I$$xT+n3t8a!BHXt)&W~2L=B`9%`6G|T z@&W|kLdL_!-^+OG59DBVg4eh}^_&B-rH5sGs$rBy%jVz^56;{gbuysibPVn9(!fQ= zLPn4RjvazTjBxewxlFp5!}@g>AD0fog@sB`rQ=>%V)~oK$DE;ka5+r}OqIRbchq)) z1qK6h%) zSlIw2gQoQ_L(`6YVGF(#VBZuaFsR!>cmdQoAQ2rb$j=0PkJrstL!eht0So$-my1!{ zl_!57f1X7TY9wM>kpIz;m-`EGEWO(Cvh8=Yc3c9*{@v10cOxy1P*2lf#+1*wGiCjX zf5_;xN3|I_7hi9WBexEKeA^{6EB$Cki=^A?+sWn+UDrxxy?KsmW9l z-pZwKN&>D|XOvQCzT5i4r?xO*ysr*5kLv$M)I~mUkiEPqRM&%S1n7O%Zs9T=O%D1s z&3UfcT7q>Jww`Y*hHQV@_p=CpfNn!-TVIBzdV4;lA&ndSbLLT2g7Ka61EWKn<`Tit z2+nxABo{4UV>sNaF69I3YGikZWPTo@ysRGqhnHBy4=Y=kDlgIp%)-_MJQKWD#zfKu zdRTl~m@$9sxHQ3V-2qK~7or1@T>q2iyVJ$NW71Ho?goL4f=Ub$o0J6D+sZ@FALB`lQ8qf1-2=P_iAZ>({W zBjvZo=IELp9W(tD%Q@H9b**8+#w`8qm1i4V$7jI}RNbCJCN0DVX1@mRp-wGT~e*3RK!Ta}}i% z<|8HS*W6-Y|b?Fz&-+tt_N(^Wg9G&olQmZ8N%Nn7+T2atmtjE<4 zm>U3#2m2C+224#=b11Vo7sQ8ZJ3%Mhd-VxIhoh?lur+sY2{s5?mWe_T zQS#;k!IuV3!Az1Ie_lS<<6tT74`)@cLwwPO&L1ivK3IM9QOf*#qzdkk-x7np|N0m^IJuuJ_m)>9)gHF3EPZr##;T99(Hqcn}$>SQy?>O66*F z6+))Nu}IQ)2#5YXBkiXB_Kc<t(9m*CKR&a+x~coSoaz{@5Fb+!NtcS;LSzHFNCJ-H;B@l-rp)p>oCW z_=6iiU#Cyh6ACtz6fj$)P7KDa|9z~>8vhXK50nf)I;mkjQV`r$?bo%nQyr8053_v< zstDEE=&_WF7WqUVz;(5WWbbuon3e0Zsi!8B%+~NMtcd(0KCb4P=RX*?n;7L+$N$Od zWQ|+?Z|cXfIOTsVj?w?8{gD12id#y=?7z~H6~_O$7A2|IzrBU8YwrKka!faW?&sFI z;@Q{QP^Mi|bY`DTV)D}2$@htCHF{?J!%aIs%D=}#CF6PXTre1l*jt+yjBKk9t|Jzl%=7W0DQgYO zE`E+%)7agUpPR1bI$?XaO9c%(T>O2^+x6nD#NrQZjY*TU@yiAlUprgRM)Qa=ql?wX zOzZs8Dor7vps&s>3Ms$&})C!qQS+BAa|caMfm>ifv_ikKAI zvisd>J&160g{>N#Kv;7}eReO~M&D^ax=)z)qWyXbANz@&ox5k#I$3YA8&I?FkXl4` zpjDs+FTK=Me>kNX3B}Wb>6gV^4eZlNnn;5He+U<@OWWqdI0N+s3yC|}1Lok?Cwci# zL4Z!I4GeCb27NCyLvMdo zEbMk6DMl#bEub~2@x?~+cd~+|PQK7*&(AqxV6kq7X+w!OEq8sr-tGG$in2;&)0?PHyVya;qif1vtE-6H|Tz!+SyEyOM6PUkF z0GpLosWnDnlH$}sknUt5r5WQy)mG)h#I)%A!GnQo)44qKyE#GeY;M=7&MrOB{K2wq z;k(&lgu)Mlv(JLQM?KF7ItSNj!?CMUZ04PO6f@pKgDE;XyoCyRdbNp_*66K6x>l?A zxhvc@e=Tbjpw@LEcU2+mEozI43@XB^%DDyUA-BYQ zwf49G3OKy^7n>kOE$Fh1MI+j6U^S<-O1qP2?+Z_4^V`fN)Q_5SC#5*WT3EDS0cD$2 zaxx59vXahW2;77?+ka=o_lSu5bqcWdy@}YtzW-IlrsoAh{fPd6zswcD^7eMqRdc0q zon^^72#~xE9U}xYGIKmcVfv5QrQ6{KI86WEOPdBJ&UVTO9V7hsp>QdW)`=!lV%fWRJC3A{hD& zr!~1nWdS9UFjyX@^nstCQjpcVH7O%D7|069G=2`x8BjxW8rHYdyXk|pzTFm%V7KiN z>+FKExm=qa%&;=QdqgyrtYH0Thke1x#R)ERuWb?^+JgFbn4*RnW>qGG!u%s|TZv@?W$S5Z-JJffuG9Db{QZ0p8L11w@$^qzw6W51mzeyomnx*S8-gUw{yj0gq3 z4~}X5qU?QXF2w0Ab;krR6_z?uDel#Plk&?moKTg^3bA^Zd0olU_yBwKOP+Un6r~}5 zbl-`2M|7)%`%bQ5c@UAFFxZ9gI;ydU4Ss4^QR^FB#K03>EIYeYb&m+|X^=|R>CsV` zL3w@tw~73HPc@p%#nSdu-(|Rope- z^8uk$i_ttAPedbU9|)YlASMouNnzZX!$V)v85e9`+bYm==S~a*;&qjuOIGHE2|D{P zmBAyIt6`3>?QMlsuef4VC2oX7ux}h4gtGJKFjH&pT|yfK=1JTvv0)jpP(i-tjS~4G zzWK+}idA+u zMzw!sGeuxu$X)$PHL~Gx?6XM7H~5s_xg(&5Brrn~7Pe*A_IHY0U+gO}h_S)ol%d5m zqi1d)yRv2KlEWj{C+in%S()1n1us6gr@SV=V$^e`$PbGFVpEZ&v$HA@pUwETV<=>d z3Dg*fWMt^< z#Df9<<~go%YfgMm8mbUr}a&m zjG>j2ihj7yP)~cNzE|}}-L|+%5FHf9n6hUtQSoee>bIIX<~L=Pd9+yKZ%HN%LNz;c zTV+36%>2=eV{&?N4gHba*LIkBT{nx^IyhH2i5OB<-yVK8q&BQd3am4Fnb3xKQW*zl zR5R%{-Sixet=3qqJ5(NtPaV$veQU^RH2u*l0T*AqjLiosRoiHo`wCJM`Q=7Ef3tL_ zLgG163jl6MuWcO3H^s`({SoHWp2+K6?zxuRPl-U<&L$!pl;$rZfrqdDzKO!J+Ek2k z!|o;OA%Gs+*TVo1iCQt;>=#4cn~LV|Gw{n0v|{eYk6XT5-Q6pp=7C-sqwri15I4Wb zUSCWXsx~vM7kjFjjCp$X)nj?b+uuK4FF?*GZRF_UiwLb4)Uy>wWCP2N#A{c;NBV~1 zm_2_;MNA0~lC-*uq4vVB3``~AoCihpI@&@*aUvHotlDcLezUeI_t zpUNhD)IFwWD*{NvU!C;a{aHmadeOF{K*b<@*mx2UNrJ68J7Qo)@Si0ae)2jXtrij* z{%fCi-fVV^gULR)S+nP3n8nc~|}Ok)+T$>D-Kn7i*%2$Thfb+}It? zC|2~TNhn2q1@TV5ZWrnlQeZQxXIetluI*Sk0#{7ui9;t&Qtb>PLi;Qt+)vxH*%@OFQQE>x8__pz zb}tVr*F9e*+J~HDPI1|p7Esu7xr#D|M^7#Imu24bRPZ&iz_^Mx z&njAn|2~QM{Y{2=bNr+IjIWnph1tQIaR8|lRM0;lW)hs>8jeGoKCH&7ANcrNmZPGT z6!#`wQ?N&0OR^b-*m60S@esNou5NEhTJe*#FRj?0p5JAi@3pb@{0RA-_+DfXV-NNC}lP;}Iwr~kBRyyE)JNeH=}JAjYXQpL}&6H757@-zBdf6-0lq~o``IJkkGarJfudr|;kG~G>q$agK1SR`A zpV!ye&4QrBI_FoH!q&+f!^z`Zwv$n(_kPkZnQ}jA)T%b9et{)6|ufM66s4?9qklG@&ctyUy^-$mrmHG+qRIgdu_4qzH@e@TwsM z5ZVp0RLkV*f$gCE3g-LbOM9k7*Aa{{C*9WzJR83AD~Z+H-IA^A#HLRyf74@gnVGoB zU-p}RvZ~6|ly@Q2NxPUd4L49ogfEz;bYZee*AQhD9e+Or=||IL;Iit&WZ`i=#OwYd z4XYOr12}{2*_9+#4X2r#!3xAm+N_5P;7RrWW`KgHcBB!^CktE<;BSZlh;;`H`%j<# z^b*IjB=!XS^r<-<4>$)y3!X$VeN&7K-BikrRznZtHfF91y*WL3vfHuyyaPmtkUVQI zSH~Ig9&|t1 zVkS1tyF$O1#v{B`sBlSKbh!o0S9&rW3q)v+q9^dk=SZfwavfe0YrdG8@0#QvwfC_a z;69Y&Ytjl&%lb<7WPLbub;IooqO>c6V)aM;-kBa;KitlRKeoq=W$f!c{wWPCa!>5&dZjbAM z$j9@ErZdu)g&KtEpL`NUoM?JK`{1{W{^2ySxmdO%^-U27DryvBYlUE9<9gQbfxQKf zXr)jI`z=HbES4a@Hs1R{TFf5CE}K8f6R0Jm<$iLMg=Ev#(~o>S?KLLY9PnPFJy75q z#C6e$5|Lzqk4*h?gCm)K3i(Al=R7Gp!s>ne@sseewdwciHo3sm<-emaw@J^j_dyz- zUwUXLziDPtCY@)(ZnE*8^?m%^SiTR4_@SGm)12ZyS@AnlV73?bB=jIT7(jL+M+k?) zz@R(Z31r8>;mu}lR6h37&n5vE96p0sQYb${W9TPDYzeE$QC5u=tWvg!Vp#FC+Dvh; zbZ5U3+DH^`^A|fYD?V_U?hMbzhUt6_rq2&)@`D)mL9_Jg@gJw?DTQ^BF@2J?cx~`A zul?6C4-*{k*TIwbf4X&;N{}(Mam?W60U_-Gh|-7#jk#hdSP`uJo{T0crv+Kw>e|KC z)M269T2z+)?wZ!mZ=TtlGNMpqbG8ZPGTkx!i4pfAsXv6KieTz{Z*&tAX8tf*U%xy- zpnU#JAdD~hF^Q{*v<%zVc<|;k-bzEjJ*LNjacLsA6N75rs91FtZVaFg^tA7#^W+$1 zmvF%VcC0~p!my3rFNMbh;iZrh^TWLhRMrQ8oubxk2bHOs>6fojwyO&_h zZumlfYNVv6Cz@b5YmhZNT5XxKi8pfpgLdzBluMgrGp{pjx1WWtp+^+x+QG7CH^Tp zYo%wL*aJpf`xR=Mlk`H*t-TD)*(l{OJnrbzh1gBU)>X@BjlNKWoWd}EGWCd~iZW~~%7A)Xlh~dK9o^d+Xth~cOnn$d3MVh0nIh*^0^Sv`2BS(1VLAh9S0(4^z4o=;M zn@YcF1DTXJsIJzrsH^u-zZyBpqdCOqk=HoSEo-%xuv>3=AQ7L?a?BoHoN#}C%)F%a z)LlR?JQDx>imi?GS`;2-udk^Za5ku}OQboOBxH*t$r_n;*ZIIFvHE>yX?L2#B_d); zv@XpyKbA8H&GUE95Gt56J!+dWsCrpROHaDV$^N+BIq@d&yxM}JNZWXUd!PF2^$SXF z(_mM|_i9Da;dV6TpXRj*&FmGS9I9e-C%S`fVfoksz1Ejgi0x#f%D49+p6Gr$>`0*smL(sTZo7oq>?a=L+U-L9Yt{Z zcsbLDr5pB#Dqj8;3O<(|hNNoGO3#i@zNwypie2}cl-GFeE&M&drBb(?29a`zFjXI6 zjEh7ZzqU?TKnES0Xo(el)>u3p-=)>4R%Ivsg zEVKf$<*nSWp}09-@8~hxbSU74jH(_2<#c~te-KY>y<$+5nHbA@Er|d^w-kB`V>BgS zKn*R9pAI8Zx7%nKYr*EK`45oaiI%83pDhO;%W~)O)fMz&RWM8@GI&?NPt^6ro;%@g z3W#qI?Q4m8{YL!ilEXS1Mg-!{IcE&vIeP~Hc8-i}&kML7EX;p@V8BwsJwg^jnDO-^{?~APr3>pW2FCbyqU|9~Dro}L zXg+KF<$RH=6u0mD<2Fmej`**~qAXCw>-8Vbp0p66V_f>wfW0zYIrH9Re%2=fY^Bjt zq&y}v)$w;rf-cc)tMc7M1|x-ibz;v*8xmtg=)~D+2b(uO)Odhz`*}xuR?(nuYXChH zd2>wiLEz1J)vK#10Mje35yAe!dKZ%APvac`n@sOK)zQUPC6+ulJlbBl3lz_`T;0c}$7(GV7EK3`X5*Fy--+rbJ}QCha8pUvP_(qo&GpE$T!0nh}FT+wWYOpMF>T3+3R z$3f5#0C?m5to8;KS2K&U`-3Fpb|XQO@|}|L23shc>dq<9RvoUI19Z2on|{ocJ69u;U5Kv*Tddb;XFu}h?yFvA9q;GSe|9SsU$XO^nT{* zLm}=?&L^RkPyt!^&+VecJ0k4{{(jP;bZoXz--S|BoTHepY=Vh~k1-n&#{uo5mLmIJPKOm{L zXsI@Fdk$u>3pzMEb}&DGUEd0g;dAQ=*>?1GWtm>fbHnKiQt_pLwv-Qj*COHY8NxR{ zDZ!qtYlHY;47KH66GGxvrZK@PvgPWt!5qH0ZVwWY58#eab@{&QnG?-CDrmU|0&Ojs zRHhTKi|N|S3}T*r+<-yr0X)H;71d2iZ3wawroWb?4~=7zY`oYWh^C8e>Zt=gC7H&Y#xZdIyzgt41VJo3G>WC7$_Ky;)vC(qbj;-@{gtk?TL)lx_TZglk`kHI8kg&8%x@Zfh*~yHIb}QNTJ>Wl`=UJg?pTvB$FJgTthv=vIm`g$X$a z|KNyIgvf`29`^NFJBUJA9`x4W67lJ1FxFvb{IW@M!l#?5=J zaBk=*l8q&k5q;&Q-gQT)wXNe?-;{a*K*JeNcpyLBaxI?R&|lm<{%HC-2ML;XCmfaA zbHY(pfupkKCNE{1*5wIqWorgXTm!J0oIg7PzX@uw`V?{7jQ z{1E(}G9#x)EQz*ZIngE#NE(MIsd*u^N;T4ns1qRZ-BR&Emm6ykgr=9=0q6#7&pk&MSK z9DbiD^4i2C4P5fWEVuiv|Bi7(w>#zfr)uWW0YMa~+2bYi9(kvp`Jerl+*kRbJKQh}_*2QXZ9fbd+`Jx9&$ey-| zl`WCpWIUCxDEc5s;pzuP8_7oGwdNiuue0NKkoo)=iyZ98qFm5d%;$_jD>qyyocgA zX1F*HBW)6!f4nPB@mB0QfqV4{r~jZ|o;Lc#YaLKuMg>P`j$um>Uy{;wVZd!U)r5&# z!%q+4Ec|vu=GG>EAo+ElR?be8$Rz^Vuo5$0AFgmV<0Chr%UT#a0^tn6SSm7z%Wf%z zfxF2;pc^Dc=w^~MmE2@200x@p|4DaT2mBpR!APR8Tx`G}A(+k_;bCR5O;=oiO!ILy z!ZTa*W@tQ>aizG#7SR*m`HsVX#i`E|>mmpXFCDBjJQT~Cc$^yuUYNFKcbJ;Nm1QkL z*6ZD1#T+kCgiGcwQFz#fk03Pw@kIv25K7ZrW%z*MxfY_rT48M%pt9lQ<a!5 zT```@wrKuL8SQ}Vn4+?NXa(fook`nJIVx>aGOGV3yJogb1WNL9VXD~;k&SoL{SD3v4D59Mt(|p;J%Jta+RRN(All$8NJ&W~*>79mH zBi@(ylssigqMP*lU}g`^^BtNQZaL~WhjVefqeS6~Y9c7m?&x zhPSf-0?TqsR|IALblB#h>_@{qBI`l^$_hh`tDP~wuM=U7h)ZlCJ0mHRUm%pQ&!XKG zgWCIiPPo3f532QI#0$iu{m1HXGI!bt8kZyA3X{VN7A`E>^s7j7qrauv(_%DN33C^@ z?3(Vu4E0%v_yHqOVjzZ5aD60#Vj2IP)fW#}yGDhW`Jr$1mE513FUjvL6b7Q@88;5n z_mcLorU|*e|J|Wgqfgas_05IuNMp1jx>nb$AIiQ}D_Z$UYQdmxxZ%O!cl;G4!tTpv zkotT~E-Rw|PRCYSDC8Q(t+;Z#J$yTesl&0|57zCxRZ9P5<^(_1{`E6~+mV7=bjz0P zDQLO_sa>y509shR+o@|qp_+2eHC~?O3FBFkQBJ`4FbT?5l#77yr>ig1i@Fn+`nV|< zMl`hX6!d92m2W(c{uo46F=ho+<<$0|M5YH;?f+FKc`xGOsz*n<{TvdG5CI-O2-wX( zSPfo?-rpD^Uy@$h86xLAO5E^>+R_OYI#vg?UZK*7*3-MlW0Jh7 zOD8szS9N_{WgbCajzc?+Lkh!7aCG$K*QOVf)pE>H+Ua4~*{+2>C!e3*<*~snOFLRB zX?w}OGj76RU)Jos3cB+kHhbt1E!-$qa=bHEeSG#*r90GRy6GeP`dDB&C2LxQuzc`*3agc`@^2`{K~MFmq0<~Izs}LCIMismbs9DX7n@k31lKMZy3AT zwL;+I#Y$+`s8X9qN^5artfE96k5X!L%1~Ed)$;LPlkP5I79h8rZ5!^l=JJr`c@)a! zg3LOyd#W7CdH&>fZM%OZPs14#U%J`f$anxO7g{;yM9*Q2bW(-tqXwiqXgMQ!8+&04 zk$%`3e9npeWT6-nZ5M76MHQ9MIwUH-?AK#(dGUk(Axx#}<(-*m=;}+Fa#5_7;R|@~ z)O|VXOnP^9R=;_p_2m8{;SscXV4GJ6tv(xUdPL>(d*V@zwp zE9ljps`B0MFZcB&$jJH6_z(KWgCF)#{XcQj)f?``VOCC1j=@~F&KCRF+jzs=EVbFanVKa{<#?(nikh*CBuCfX_;@ zT~n~#6hPJn*L`OKK?oQ?1Hh#*lN0Od_G@nnrShSBM}ko8I!ey6bV<8q6-XdKw_eXY zS8;O*e~?N3?9tE^&Fy1t9ZxUCbIvS7Dj3uMokYmz7qRr~-=0xMe+EGsG3G&iYdfzp zN8uplml)~`^bU7L23*#h8Nf^8=cEc9_^lWCR}?b6>H#Q4vy8OuE`j{a4!?1fyJ9a; z$WYlJWzwTwOr2evwqa1_thg<{aVs74nx~ea?-BI6qM1GYfOgHLQ$yIpekM&GjL26b zAhfL4|3~1%U6onq$g?a^=3b5Ns(;j=dEluJ5CRHUFTQ#r2k!9+3Pf{7@$z%zQraxc zwkuqjP!^Xw%DwhVd(uoStrK|m`*xWV8`M%PO(Z+f_r=2lG=JebIz5)zGccgc%pRKq zNQ$;nPrJC}(L@d3ll0JUd&Xq^tNiZbWrg@dG}V(y?3=}PTM?abi_6c z(HXzO!B7?Lr_r{`e~7AR5tqTwOMd*aGnT{-Hy53+ezzySLqosWVvI0C3b=DWGzNc1 z1ij_uDO#pSe1dR1s0cBDT>${ltp>+<+g1LH@_h|1pQ{+SUM9SAq{gf7H8632&0Ov+ zr?7fm8~0Rx(Sr~l`v~PvHap(@#cF!7hm(ovJu`_E(?jHFb5SaLznPb4^ElRqDSUsK z_i8S4KAcZEF?8Licd;;4V)+jsUFX$mr#G_kb3{cEj*fr=H%d{@Ot-nKcYF9))Qgz$dVXxhStR( zu2pL8tY~F9-!2-^c8u8P8q@MsvkiYNGAP$^ZEGVGO0p=(*SOA-cY3h?JEfR0EzS7R zc&YA$0HU{iuCX)Jbv)1Z4=i}O@|Y^HC995w%W5A@3y_6xAH1|o4ZACbuA94mdvUF` zn#G7q;Yse#(%B|GB;8xa(cb^ zU^L<-@tUB17{n%9yA_F$&M|r%{@@ICOtmw)Msv3oq2%dGW+p7ys}3;4g?QUy6aIt8 z-Op;hKowF2q>*nFVT-KU_*2c?gr(tl1|zB4!2woU?GVHn;X?g(u3%n!3TTmL7m%9H zZR!w+^Xo2%d67=7k!D5b^Zci+JlX7fp{2?QT8ZlQHT?q(R)2D60m_x9hOxp)&8haU zRHs?Y%UgkmQv8A>Ms_J_R0eNl9Ng42|6C+YhrKti?O4}<&UmobuC(VVzaRoGn9>NT zKL72_a7pr5+DD?pyr8AuZM=(7~ zw(che&0?`y+3ho~VDyte(M@I(oL;>conN1lS{+EI57ebCLaCr+S6&~t~nY{ zoHB?6I9A#9hdWudZthDG`cFQJ>%)a?IuhpVH=92HeZ122 z>jnQqKi1{8eWs4(l|JXw`hP^7Wl$Vn(C+^cG`I#2?(Px@?hrh9ki}tfmn68mTX2W4 z$l?TNad%%93A(uN<*mB!y-I}28#70YzbOM zzTQO?zC&?mI{Q}WVUH#sEU_7%38^j88@N(V-dNR-f#%1L)R>b_OiUbH`})0lKZ8OG zb2N;Ak-?MO$AfKl{uw%3P7jS-Qvga=6SL&Y8~99clsiNYT*Z={}uD-o1yP zd&S3prHoepW=SB|K++kEh2j$Ps*Yq*G7_Z>4~epu|I_06zWc`8`vrF~?oXMF{7_{R zD>()ER3$dX{oRSMFUhzb{=OlKV2zTcO3vr|6DC3Twl*O=ifePlW=+-pfdN@#McoET zqjKn!kkIz=cY2Y9kmzjQune0qqS%LFsm_aX{3`wTGo+reHUnbDjC;4wG3Dipy0ZQH7G6YL>vH@Acq{YCiHO86TBs}VjG%%%TFHwZ z)r*isrQ68kH^vskHr`7#)!_#;sv2x55C0 z)L(_KmCIc6RwNn9`7vcQeLlO#fH>1OrLANx6&f{=L4Om}3k&1A1$VuPls)g%>9wX> z(n!=bSw!F55SyyL2VWO4fae-2RPix&WQViCK(_5oaLq762nX6 zFeDOdbm=F_=S&}P0I5!X*Un$K0Q%_B?-JFUjMMZL&3}vF%@}~(_p$55;1g4ZWAByf zC%%d1eW|(Uj(V13~H;23pj*Y<2@qcipnycu7a!9HYcW)Gv!1YAhtK}MekX7xYQ#2B5Z_FmQ4;U06dH-<$;r5!sQssR zwnnc=^Xd<8>f@iGjr&Wf-M9(e7DNqUS3Vz-#$?~01v&FtOIao3x1#U&AsPO5;| zMo*Z7(777j;0&Hg}Vvp6;q?^v8ube8NOq`6;KrE0-;im_)O*zi%EXS)Y7JNzSlJvTVMxB%sb; zrVY>EURDBEW7-Jb&HC2WRP&AjqzdBdO&rK;wur_VX9RI1xXnR8u*R5=!-aCyto1S7}vjqXmyiF)@{6WoZQ zs4cBZ53i6GKDj(Jf^;bUcwdcjYAi{A$o- zk8S;L&pQ-h=L04e2zml_qN93Di(AY%qx5hdcjn5Azym*<;8PxC=7 z3gNy3$IL(?&j3MQ;u`4GHZ8fZdqRLURpQJc9>6ZHtB78T zz$4V`$*{!F0h)eM1ZTFEd~S=5u&dN;rn5{JPgk1OI_yI&x}kAd8CRt(_F5{S7{~D; zd@*k79JT2yWAJb_!_7^jIt*I$ewRucw~CwNMjZ(%KtoJUmi>E9>}62h??~S6sJ!lA zsYSp|{r!s8CxHuQ4Y{drJE$MxL1izW4FjDZA;EGNL@YmGYnol;?UNg@GcJ763+>LO zr%RfH=|ZHJS5@mw1{&_=B?z$T1-MuJEE{EQW{7CMGWDL>fB|T}V_*&(m+zl;-H&a! zPUpQ8mWzgG@&U6uPi8&u)&Oco9i?4lf3Fe8xk$eW2Uf%L-PG6I+FKO8yp&!KFR!BV z5T*z|)TFmcEbIScF742M!G?XK7ABS(s;&U%PCo%_FYAq4!G^Pmj}#Rel^>rC`HNpA zo3Cu;_*%@WWP0NSwm7BGtHlI49W_vs^4?+WV;plG4}!(jxjt{boBp?r89M9&;ItnW zW8}5mbyMeJe@jDj+F^#cz7dn)3f?QyTMq2sC@>AS!Z2|eczNWi5e=G{wI;TmJ++{5 zR7TRku%C_6GMmvh{cSr)y2gd9@hRwydHlq0*LK?xUFtHT+3N<`k&cldb!Tt7Y;1D9 zUiuOnrWD=}o!JWoUY8pZbbD z`Fj;@$(fSBwj6NZEbHVuv0POBp}Q@4nH8Jm5~!@A{hpy_`eihXo;xj~-21U^b8knz z@6O*|$mbG9r<}%SIhunNTwWX&D$jZZ=6Faex-Cq(H~n-H=uU^Mk5KIy=g*%8UT8el zrO5CWyCPBgSQUTIb2$FEnyQ06wzkw7L635}3ic8G#pz^qI%08S%EFvTIDaX4%7iIQ z=~O#c_ciH_=jOC&O7zWjWfI3>g zxH>t0>*s(5d&qhbeiDV>>_`LTHXFl^YB3QD zcx$-GUZ^)&>n|Ko272hJ6;?sG@Xiil6i8=J3z${Uvam}v?!U@SRHZIvj#-crcLGJW#LZfAOY z`I|zERZbtKwDnc-d=xq^v%g=&soL{~1Q)pf06CFwj#R_Bl~dwlLj|>FF5TSau%oog zWe=0C@0?uxx+n#7^aHIY#oBHTRMX8YS}9o4mulq)HSYJA6c7Dxh|aCU59Z6Lf*)>* z*YD>QW(-w+Nbrrvl|;n1b&_Xj+(_pu}n>I{x<_&vmErPr;d zzaWt}-o4)|F+1c*soF?86Nd~D^DZvw4RQs|l+mc)Y|WBnACGP=U1+!;t>@$BV*+-U zV$BubZ~6;l;`mu^?2$l)Spthk4a0bRW~Fu<<;3#2=t^zE}Tb!RmXc z%+Df7|C(towuk`YcQa<_3)M<%Rz8%dtF3vz!`30V2d_&zQKu2jNV2>3{e>o^ zddESoN>zLoo!YVAiuS`UkM<8W9nsnCOG7Y^?V^iKmz^E{ys$8(S?RP!$;L{PxMPyp zoqxwMRo-fcZ=Y?c(+EeCpKC_L{b%X=Ot5lWe_zqvsQ-`7!{QXX;>HZAa?uVF|0w8k zU$r+TMigmU`jo<&WxRZPx>17hZ#law;Ncv0Tthd2!h1N&adotqe=05K`Y%!SQEgi*Gb^Y~^88saEbx<&@{T{96G_)4#bA6By0i zM~W0dU{XiPNbaUv60VXSj~%^-;}(DKKTM#@`B8C_G9aT%Y?(OY z8-D=KXTPAaT{twOc_$~}{xKFqRoLe+3vYscvvPsSIOShS)Xx41vwye-nju@BAY+Z4 z_TSZYRc2x!?MRapJ_N|eVbopo6exJl`kYYpWD!DXG)(O#5Ek{8ygq;dd^~D8#K6_A z!z^vy)vS`m6C(ZYAJ5s{yHkhfUjryR{VQJ=*zeNN+_0EdIqqC>HSz?YC0jUO>OaY^ z@c*0al~rz~Jp3~Fg-VLk5dgPp{~6Ib*#TT+X|Nx{-YW|~%n)(J@JjQvemGR~I9*I5H}Hql8BB;TVHVI1H{;`t=f`@=sL^nIo>7^pV~E5HEOvEv59`q&nO0 zX?e24TbQLUF|S6AongJM5RQhXJ2J}Y$#Y()sLa5SZ!!p$ty#Q06mwTB5vt{f=L`MB z8?;nH4*XKnW)tmU`EQQ1MYNkWdQ!~H7n+naJf9b78e5>u@0Ir+0X8!aBC^#6O8C>9 zMj;1LagGo}>QLQCN@)f{9hMV1m5MRXi@w)Z*RjNR2lLg=e9dov5d5eE|I1HG0pSD@ zI|{4Mis+=?`+O#KmNCs#)EdHf_YrwcH=;S7A_!wc-G{<04z;QIKUmk`>~Tj?y-Il2 zIEHVZxzc$H(AG9@-))}Z+N${WhfwDVZ);|52iv(_tYTp-TkS?el5I)cV?=VTmpmJx zc};9T+(MV%(*O zpMTtwam*B3*uuUE@VNu^lVC@l%ycl_3y1Ki6&*g zo@V)rfh6d8y3h?>6!bpUJsusN&ts%Yies`$tIayh|vwi(0Q z3#+EmOoXJna$7kB?O^#&RyP3yj~=>kORxAWtKI`pFZP4|TL~Ick3}tIXDxXW*#k%~ z0F%Wj1)I`)NcYIh;?#=FUS}LTBFAnl2mSaB zD0f|{D6ieSe(S;uW4`%N6t#;^$hD{7Vh!le84+HliwNeDrW3y%4fn(Z!J+CXgk_o? zlEgd@LRt=AIB7iDp${LT72+w24mt1_*9txF9oE{fBgjiGK%NWcJ0a()ruDP~yh6!! z-z8@VpA$q{{UMq=?;00RrFR&JOm2$Zt>kMrqkh}G!A@gejh}{mfyk{7Z=FcpSJJn7 z?Vu7l+U3Z==(u93^29lcu~jA~e5hs{jj42Vx(0KDi9?8IyEQ6pD5}L;T*E|f)n>r^ z=3)M#NwK_T3EfA;yH_)bU=wVR+zCLw*$RWK%!J`&$M}^`@`^E z*LnHJ5?Js0Jc$JLNQq8Hhs1c|yH~!!fS8D|D058? z-f~~^aiPZEn<7cZlxUE9p5E0U#sjl8X0Z9qH&7*+_wIPBNXh&kLHI%iP1+qrDO zd5zd)CY*C^ryPIKeql_Y5@U_nPog)rTYZ{L2wuGRZrg^Ph7D|Ro%;lYObd)@R z&*9hvgtFV{?#MASoOBtH0f9OE;T#tRpHj<69*%3QaEKQ$<*n) zotS|OBWhvanG5r#^2tY?gsUzug9_&;%*btUp4`=X8rhz|m+ll2I~-a`{(8 zf>2Iq`5)@OUdyZ+r8-rJG63n6SkD#|e`6m-&BqY+xQ`9;xkT0l`u6_FG)>wu6bOBY zjRINRSbA=ZE7t#a#}!}x#c5+0Grw0G*F!jZcu{fU(B^9i9>4u!sV1z_@*3}U>OhU? zj7#mMn)+mAK$&17o4AVUb#fOS7L?;bfjAIQakj5N14t5lj068N7>;f_6l}z>QFUvs zz2JH}cFGhyEvL8}gq{qxzAf|Q{IxoiAzm)hN~UhL`J|>z>XIO=yvOTz;mmW`8~QPg zUh$^Qs^QEa_#8`$50co%-y0Z$E(%nP`o0-gQ*GLww`6p3pevdUa^%shE@A$fsgzo& z1rB^ynLZY3vUHN-rA2$JZ0Sxzd3rO*U^v}G>!0?FnSMpwOCD(vg#-jCnrl>IgdT`` z;47kW9;Bb)(OMl7r#c3=Y-07x^rL12gZkJuZRn_^v`csJ9ReYixZ*5|E7GtsOnW@| z%?*0=xds|Hyx$-MSTCRP{O0m*qR4+2cy=v^ZWFyDnv!2fJsNzha}d9l)jjI<Dx-CtSd0|qj9IVA|2+}n593n zk7tFpGwIgYs6QOGxDkI%k64xnuZ-%0DzF0m}?I^7UepGA7*H_d#a>R2O z#))L!oLcVz+8d`jRpmEHbQt+25mvcOQv%slu)&kpt}>3bR|IaybFyYJ09&xf^!;Tu zWqNsm!)4bM$vJMP9ieubPPO4riVs9AmtrD+^PB}okVTm5B48DO#Z0)=@BONcA4kd( zdtJ}J^?(vuGYqrp%~k{+fs*%Fki#=Y+%u+96@xGKF4)Kzk4dM(P<=lcWY!KpAyW4n zj#9o3)ab2|lgD11u8kE=>9k$mHns)GX=R}5YbIhtDL44o>%Q)mz??93h%T9(;jB-5 zlb7kyQAsc7zZb&ttPPbtmfSBrd^+Yh6+s4BdED@QU0!>U_EVuqB9;$h-1K)XUfkXg`7W0BZC=|fvy%2 zm{t0y-|7RDc2`4oInq;|5<-cYbj2`Hu#I)njMu=as2V>k0bjoTO#ijWHd5)IxDQQL z(#{LI*Qhu=cq%!?vv{Cs_)HNd<)P{8#Rc`1|Hl(V`CHXT*=HWLzpQuK_AC?}uNa z@p&&&GNXf(B!M)KXX(#L-I$>1q2IHtu+w!}ffohQbI--<3r=T$1j#?oe<9)1xqrWy zz6H(g%=!j8h~tI@wXwZ#i5xpRkWF(3(fVWSvQzav{lv6gY(w5hkF^RM@;7e{Q);?M zZguj3W!NgGO7BBuj*tbW@A1x#Q)WyGmF7#`Z5DGjs$NmTzNoh1$Et`mz4G}=cCx(p znjOw+0JrpVQ4FWmI5kz)^NtZAagOXLnOIuJeT+iuGTk|SGr%l%-xO+DBD1mxp3F_w zA4`(`GQJYoBLP0!wG>#H$=0hHY^>sh;+|{`lCr?@w{gO9Y%7{;zS@WXkqL zZ|-CmBJXlnJg(yFLV>O(ZmF2Blp!i_HEuUJ+=hAZ+5HtgJOMBRKQtb$ghRO{cgGHB zo4FJC{le0Lcu8=z+&7%YQQnG@1!@gQ#a>82TPzNxMd~6m zzV_1qo3RRDrhWfKE)mkju05VgfyK?o2dYCTt#SEMK30Sew=KtI0m@xy`|F2@dGr468;wACN{-X|)hM zrOhHO@vNUOtNCpB?%K=Q#RVsB?r#o~@jXbN!dG>L{e6JW8adlXtrFVK{05;&{AHdF zbom3svk6bmQ^o`P%2b;yuiUfyJ89QTUmkJ7ij2Xra342j36ECs-w_rDN^{IrPia(z zfbp!2S5p6bz;F~tk4l={?6*f9Ze%`txl0k)@T>#FtiZ{(wCVPZajiAwUi-K04*UH!S_LkiyH}K z16`JyHDf~F#SBx+G7AjJhjv2MOA)x)r&}-%6cU0LetWC6<7?X69~kd_L<(Ktv=(;y zFi$$eQaxK#oWTCAv@Cu5H0NS1Bm?Zb5K->JrEZv)z?q0Rv}EaB5}`<;Dc<;sO#S8KbZofvr=_cIbNGR?1k-dJDg|iK)MSA#d0OQ znbt!|gT_!TFplkx`LdL60+Kmzr$pC7_b7tUN2mc63(K2Ep|%thS`oUea2K?Xvat(c znOR6Yvqxp4+LLrSKNp%|J=-N8i|=EKiYn3G(2~c2v`f|FTCRD1_8t!FI>+Kkl(Q*i zz7VXI=71xPG~0US4xIU(KuFXu?j$^@Y{6VK)SjC$^0}HcCQPqJp{`_~e&@fs^?AMF zTE1x#lfk&|G&yeiGkQZYOFR!``4ma(0nn~T-AtX1K`OngAG|!JOK%h4^x1z*aC8AK zHb=yoO>03KwLkH*4jevnJ$LPgE$n`Zj)sOd67UG?3<~W4yCzvsYd`cS6D2ajew&e^z#We7`|TK}3kS}fd0VS$x6bEfmAbDP62V*_gER_~ zI}XXw;5;z{Q5!b?s^7Y4037%95|dTHk@lXWN9ZboD4wHwNI5$sxyWP*EBRt!n23^k zBnFzTS$zTgw23~B1B2d`94U>q)TN7-pzrF6TPD{*^Fu;h55@qL-KZJ{LqS#k3YL@! zKtf(*q^Wk<&rbmxuQZCyU&c;PZ$4Dy?U@CXfp@B&P1eiU)^atXO%9iwL z+?DNCsp!8g?i7HeeMK?rzLwzR<`Enfy%FIY%?)6W)LP*=TwIusJA;@zZg1VDy# zG#xTr85NVxfxSeiqEBr^X~Afai|mV)fxsQG@G%2f+-8yHp{Cf9U^1mLbgAJkIiF&& z*>R+GailI_^$}&?dA*DtFf+tkWUtd}aBA+}Bq31S(?0T=#m;PUZNO9J@WUEOrq3<^ zYc;ewu0w))G;`vY)8cGwlSSuO=L)&KNgwvBawlVXsnV)_AIq{zCa@tX*Fj#vI~gRw zHT4)X#s?JTnyLeI<#VdGW)4a|rkj^FN*Rqln+k@Kx)%;UptHtPiT$=2Sh;KKSmEK= zrADhz*5C-Q>)a$Jt1}MA`FwH5+(&9+n7cD%e|dBC(1fd~McLt}76;kuqZli%^&9(SCiv;j4Y&x;z-eOrJ#Jz|qh3|xm^ z!N{UMsmHMgU3P-0N5k;K=udOVrMhkBv0Xd@pPR1pVd-V_9sl6;!s?}CjOLl374q?Q zYf=_n_Cjqg7_Xljmj9)23N-3)vF>4UQ6Vs}d&3=()1X%r0Vg+A%^N*bP_HC_&@|&8 zg7ZaN*~*^;6$-ZVN0fcs2uN{DFfxOn8?+qjZIjDKU?H!QW*UW*s50-a?ljsYq;QOI zWqO$aUJY?jY0#y7VGwcM#q^PY_61Asjep*Z!0PB6XDtkKRBM9u#z1%>`?NRvYkMZuQk&I`t z`w1h~@|kDDw-`7PP0+3^^*q0trsc&=*e^CO^UU zn!7kUlMq=Jnx~nX_8hz}=t3VO&7|RmQVe4djscrG7O5`FWu*&@!t#G0VaVfmJt7^g zD^f4&7xD(fI@%kAmXj<)97cfA0;rfTQDFp@89gEGgJBpSiS1XI=SH3r!AM?c8=(?Q z9pCHK#HZrEgDaikEx!9dXLu7|-A@HGfG*VAkN096R|zqesfD7^ZiIGWd5@r7)7~)M z1q=GA=ULyvdBp-L3p;dDIi#5hfrp}&C3?D=(XesF@tN1j!4G^r9|2rImwbuE*<}y? z6t9JJFA>Tztg~Tl5)#VFPIj9w&M3Epo4FaZS!&01;I0JLYvnCt1TMrx{nXL$*;G(a z+8IkFGirZKI6wGi$Vt^5Ja6Zh4Q1%}F6EOPQOKvPtwenF=}rhp$|nLq3kYEFNTty` z!+WewN(t&gH)}}wUHt7E5|H^TXr%!CA_!0CHA4~fr8$EUoP^-$J^0tu7IX~dBTPl` zTh=FVgFsbaaE~PPxBu>wm%n;J;YD|h19$o+-BMT3eE^2<{Ymd5Ow{3*ks~!?NCT-g z>i^nE_DAjjOgnHm%l|V3E|2yQ!|O==KYPKS+u|eqUrR-xE_YVEzKj2Vp4QSU9ufB` z{T=2L2;~JK+-Oik+EY~cf9;~~q7123uBdNd9aB$F55Uu9X5)rLJ*etZAQp&AFVl*} zNW8x&_r;%;&miYy-^I;qXnb7Y%#teZ>Fi4t|K(K=EnW=}y=w8hv#VTOOU?h@x9|dN zcAremsu^R54}^Qfi~B!87%@n1(6T4Op_Wf2UlvGmTERgKpXF;>@l_ zyHXFbyMQy6z!FrEZkQBe8S(x1VOXSpt80i~7&K}J<}Zcc9eHgj^-qSMr<$+z-{@-z z!?ka69ZakL|D*Np8>m@HQ7B3es@RO&LK#llW-ENS8FXrUFRBuS$S7Pq+=kZI-w6^k z(re3FG<^pRf3A5i5uo;~9LjYYkR?Ru{0vTB;4-Yw97$4t8o$c!$5hW2eJd8f5Pq`9d+g2Y8L z4>j|muZX>04bM+;^)qVojBVPfbkf;2KZ96n8?R=s}r}>aP(>fgU6@3!C z)gE!m%5a>OQz=wYGCsD)O3`rxaDfwI+F!g}P@am>oR2iJyFGoQuS>Eh!nH~$6aNqd zptny`x%2VG$>8AC2U*d3uy~Ps{JE-f;&WI_Q@1|r8QAPG$>8jL zNiNdlpwJDea&f=hhS$I56-9EFO|MG=FXO7kZwVMX)hg&d=J1i5isfO|tWMXeqI6}n zhx-v@Id6>w5McoO7?VAt`H*-Ez1&FW?I(W)3%Yn}%Krb)pK53U``+|Rlxt@XZZLgf z)op$vf4c;$_~Bq~Om2p#7qUJuaPqh8zKizzDuUg5@|BKkg;?7Cy<2O@`kKnKCn?o@ zot(hr$GsY%i10GTGH`YOZaNvU{RK|nD{b>N{Q{{q8?##N2rkN-b$hJ8&__#S%T-%i zDR5{b>RXozSWxcrP+WkO(e^9xQ_O*)!oXu!4&Uh44S1c<~~+-$L^Jh<~s zx=6}ZX5gz9*G(nWG5U||6+O7z9hu}@GpU67>)VKYr^&x!9aj%-$JKR49kueXhNerm z5FABK=x%=1_+Rs}KVGMN5vH#QsS)e!Eeze{wzb4g3)ca-Q(&i^1<8yO@pFsZPgiS@ z+&HbNyhVQ05BcHc-mjSaH!L=rNw=N*jhY;K3X5FsUTh0EfN(pDPJpsS^|_5+K}kjP z#+R3rd>|3*v>7T#HaggJ6zS&@Uqt+i+xPBkmyz(=lV;-RW_kzGhn;O$DA+{VTRUg! zR+lH}YxvHgG1|!En`PQK*W*aa&gwiHOd)zP>)szX7?ixRWCiek1{>~()Hn{x7Q?)T z({p+Z4e+-H1YJE?&F!UtB$w2%_J4oP3zS6Cd(Nf=TA5aj2%|-n)a5_6L?p4gV?-aU zNC1V?sOzlOffd>{J7cf0O!9hDhF&|hetvslQY$pGn?~-nOQ2Nd7zbTeptVYnA5O=_ zcbVusyL^B7c1_BD`mB%)bpn1YUWRA~V|BbsA{UeT&SwkFs^#M1Sv&qn(+W78&jPo? zWr2aGS=kVeCEomc25F9s;7gK2t~zL`*D1x#Zi zx9zF9#q+$Qf3A4gyE&X_QVtEcd9PAZ%8F=!WtqiKL?h(_NTC@xh_DoWZu*Ez^hEZ3 z{A%P%y*eo)OB$*LN14#$ifPiO9dfiNob*+?$de%Pv#qVa(SLAu`p>k;(p^M#(9lKb z@yHluI*@Y62X+q??}CfSKf5SL_+Zai3b>wJ@Y9e#RhWthnh|l@2|CDZ|EH&d-09%1 z_rKqr#(l8OR9f}&_uX(GP?F8VJJk+Q$r3?NO?zZY&A0dVn!nhaMHQ7duvuN*pfY7{Sr^ z&?sfC^c4EZYs$dK{Y2pB088Ssvb1?&X5&D}R(D%QUAOUIn8jqdb`^#T_!Q@B2aUcz zn^=o~_;0+_l>0|Lr{rdLOtIkG2B#AZwY;_Qyllmor+>UNe*Lc3YqS^I6>5F1B$=X) zERXSGpHwG|2w1d2?Fe}rtmgJ}yie7^lWndp_rzm{pg7w2n7Inw_ce;TLK`vuTAw6z z`9EUZ(6g|d5yR0ULu6#&2eMp~(!Ji4L>w%g-QuA#GI*>k`ykiqSzFV zhA~U(K?mvw!BQsffp23%qBewHRfQK_c*OY%&ff3U^TN;h=&oX4Xkc^!^8Qk94KxJY zUAcyCi+>yo2O^FC&Xo8TE?6b$?*A(QzDjK|oSSp?8anM<5UIu$RE$z5Au(^t=pR@6 zQsmLEVU2rfm17h`H#lJ4Z0F1;!u*`bx=s_7?fc!1ac>Z82A|UGAM9ZMY))m($cFYx z_VC6BB#On6J1D&T!J$h3p_a4RjLF;#9zT+4n`Arc`&-j0)Y`_Gn8;1X&`(Qt?r4j@ z2>t$dxm+uxQLdPiTDMrQXb58SmxhH3jUoH*LIg|j|9GSly&=;c^ZKpB!^r69=zz$m zkw?iKoSm||wXM6*Dlr0Nen<-4NC;DQRO}PKH1lY!++hG@U|FGyjf6Q#}(_1M|XIQ0|&?1%FZKnePVNYn55{pKJ@?7O_gm)*B)uZus-X-vE z*Eb`LAaxGtlsLeWP~VBOG)VOEb{VGXMh{d+lr7e?6cj)<-8vVaq7cucPw$4BP{~ez zKYRI>c~g>3#J`dZq#|6Br)YT8>C!*gA{>D#K_@%K`(Iy}$gEK>%6wv7cSkZzI0CFm zxC3G_^lk5kq;+53uraV_Mx}fjUcRclex&-#f)NsJs*4W8`1E3m15J`30O3*f)}9;* zc^~jutL5+LrjWJHJT5I{_Aa->Yz)1%(WQ~KiWO7+`NUo^T}6=x z)c8F8F>2h~c-RJRZugVjnRe-4E))k)2sOI_-nfj#v?!-P2qBpMWwp4~((wSd>d8Nfu z^8ARj#H(?m7T%Jup+|cPk<MK@Fi11g)K(-VPyno+W1GjdOuiI(DP&V`5#K+- zON-7{^a(VgxVrh05P>)hMM}zDQpMZ(-p{cKY0DbK`(m>+sLfZA&GKTX|s5A0k53$@vtc zt~#-W6U@E}iBr6jBSJ9ey+@&pzF`BPE-7zzpJN**BmBQbg4=(N3K$k=amnv3732M% z;wMgE{vo1=n$KgmPiSm3lfae6pR|kg`>_H{p6m{1x|QXTreqseWDewPS_ssO96MAjthQ>r(w0hP6zlD6NB8k5M=EH+Jwn zm$fW<)7fA?n=4S&@>OaATT606PBb&z6dxLta_8q~tMB#S zbVY}Yn;_^cdt>fEFpjB}2QHqE@shM3v_(WO+xbaIZsChoQh)N$Bv*H+addlox~F5; zC+<}2!SYp%lZAYg*O_e~mtBjb`?%$KkyDtfhByD&d;R6LkLsk2Rs~5qpIi=xue(St z9^*~49FgcMF&5)(f^l^=cM?V(BHMNG>fk@eEG)$MpHeSOl0sK)l?&DAVsBqdamQ{0TLgVX zm-46qW{VZ#KKtYLz$F*`32+C#r*3--mwT1|?jL~H55+G(n*6LK&zVZU>04Y{d`c?c zD(lbikTF_*)wT*OrN49zT6> z7$sKWnZ1_?bW+~Q*SNvqqU!bL;LllNVYlnj;R_-$BjfT*GZ*AW(0$ws`_XipuB_%` zsV1rK#-P_hsGRo|O~|!hd_uW93d9P&s~qjlD{*R-;HsB^SwDaVw=~BZFM}4f~?hgOt$BW zQcN6_^R7OVYh$Cg`d%Jl+CX=@SEiEJ_;Z5FYe;LjziBhpy62*ayw!29k4FE5xxU`Q z-2SGNWMqzV9%5KXgQ-+ZyRlB?mB$;<`+fnqG8jgy2g&{X<4n&%mdZ6s*#1uf>8OmB~7BarXUP68BU-tJf($A-?q@EwIb3Rm>-8^}*MNrH&eb zt^vkAhhlp9&NYF1=|g#}kI@a{$^VY)T(-imm_O`|Z*Nt6Q%WBxXjEC-Kzz=hG=hw~ zr3-uZ{oGi$1KCe}x2jv4Jk2%q-qw%kkc=B6lL&F#r;Wf0ihu}W>pvA{@ZH!iIIi`6 zR`x{)_;ez{Z)!u0)HY*X*8hENcNFlQBUcKJZ`=0qVw4`7FnjE=xU*!HO=y4Tmp0a4 zpzT*_IfLtT4GsR4843*O4{^a??f{?|PON{rTBH6YD?GBrKBDrZRXT1U*<~JT(#5~Z zjUfA_wND#c6^GB-z4zTn;NpGjxkAcM3a=bUzJa#uY-<0>h}a zdF9K_WcBy^e})8=n(s-P$h`tssp7L4XMD&vkLl6e8zRup*~me}1M=D?wN9oZ^>xV(wl z&+;x~Uo);YkUi^i;^hY&9E`-G`>gSq?j;3aB*vT16c$z-)}s~K1ndR`*2}vjfwA0B zh6a}-PpOWm2>W?%zcu;e4stb>16mAQ&{oyr*J4)^r`n9ZQZn^rurEiI;97}7YVWY; zOa`mroz0WjL|#YlHZ6EqpQR4;H0dhL@Uvhs4;7bP^O^Pjg*f6w0H!P*K4$BdhmqCK@@occ)t<1a<_9}V)vbGDwbhO!X1Defb zB?Apnb0wuRT~}fvZDDA$MD-Sn930})T72zf4P7rG{DxS6U{lPR`%nK#5M!?DjnV3q zvQ?Yhu`_ZQG8v0~z|{jc>=eFI%u~Zc9%CqYf2taKoy(-hK9TH_#p;QPb)@uV5slpy zzwwFI8SwpsZEqt5?NuBjf28#pS-N;0%$%*?;~YLAyj=EtWNr`48hxmVXVR+pM7$U{ zJ~uBP;iWJdHf7!?GsDb_or?DFoF? z768nAZ*9--D(W`7eM$DVWK|)>{+yjQwmp6M=r3x|VO=Nswep)4-YJFEScvWMQfv5i z8P(TXZAlvSpvee*do*>NMQ46I>@vgSRzN=#VztL9u2>49Kj$v4R>{^EIaOX^Gmt&` zE}+^sj+xwrbM;X zChQ|i%5Vj_3*xC_%&0XlH`@#MBsVsv!Zb)182ogH7;^MWjpwBZrL5FxZsBSDVCF>7 zotqomdxL_v1%;FtdO2d2bwfo{x_9y&h86J>qCRbcgMu%+`w`zhv?}q8gcsiUXds{s ziBxXhP=dTj19%8Guk5;DoJkX@S>;mj&*ulNu`?_$^G`apBN(JY3Am>2*81@esGrM2 zu*sL2^I~9z8WQJB*KL6x;%Y~#s1BW*W9%jh+et`x9Jnet0;R$F;SOa@$=qJJo`J#% zva8@fh&xB4kOHNmP>t9T7d6wIu1;S~kupII&Qq>ZWnSHI%Obsf7O@SU>`XF_2-=SC z?&+mD9<_h}VgWubG@_>`X~HGrUX?Ol7SqL79ZcZ@jp2rs7#IX`eETuW=E{z{2_@^%t% zKIfr*w3MGSxtCn^PoBVWE%{>b+MT??w0y=;yJ{*{O7(H3&e1kZuyXu!wZpv~SD!%W zl-t&SWAa^AOU>2<9LBgobuoNr3$X?;Q1`645nejZSAc%hDi#i?th&o@iDY| zgVZ=$nn{ruwr^hnSfhqR=A%&hOx2vu2d_qx=O+&3WOfw%VB<|Jvx6-8D~dU)qixQQ zpID5z8TV%_he-{tC>2_tHt6IAQPYusBH3|!Z+#MfE~eKq)ZSOhN#h9xL9@GrPW;?| z8+l?%S1x{{){_nkn9B?($_5?#x3~_bM;s-=GX-K~80m36phAGkt77fdH|~|Y>U}$@ z-V6(*jilu6zOS1?%aKCk5z1h@)SX0Adf(e)sqL8FWijCqMlCSYYmC!iV&vU+UF4AH zV<{J`tZL+G1TKB=J);Wo*QZgTJ66Y$k(BvA`~U zo8=nb`O%1|{>g;JlJh&%#j*SHB)ze2Avu@`l~%>5{FOsadVwk_E)7xpz~}93_QgYq z7OLs?@Jo29pA1E=TJ-j+&3q7(M`zvFiXQoqZG&`)_`St}XaL!@2o{a$7@k3lINSSYT$VXfl>rVaEm}Q3>F_xE zZ^9S();;)%C@H6&n|KYO&2LV%;T~F2ok{&&peD_i)Un}zoGetDYki^R-n}n9KRL&& zvd{I-nf}USzRhTIrQ#O!NGeJGmFYh=-JD50S5;M+)| z$T$jXyQu7j_27h`KcB;YlY$t4-P55K5t1pP;f@3aa1_4_`+OF4Ko-dJJEp+;%QDzu z$CsiJ;v%R1&1>Mxbs@>X6FWnEhGe57QdOD%IDmR1&i@f9!1|;_aq*|6?+ZmNV;;5M z;mG@s&o)aMf(< zXrgxQCn1CY3GN!)-95NN26xwB!5tFZ-5DS-XmEE3FzDd!gS!qo=*PRh^`3M3U;pdw z>RM}8)xNGf_cPprK$Cf;>~Tq^167l%oPKAQs5#&NII1PG!*72!pl;zn`I&jamgV_j zBH>nrT6OdC%>90^R7LCZaU`vkd4+A|98oo%%k;r&vy}w*(GF*ypR<)T@7&Y+Urqeb z)mcXl~Leo!URdy2qA_xr6u+$;`erp#_0gdNd{E6#MCH%FN(W_6o6yCgz<7S0=$t zk{qSGH>n8a7*QGx#fVg2dofWw3JMy9fk_hnjwq)2E6|G3;g0!h|}4za)epeeptlj%}MjgQeT{EU1`^xnhAeYZ0BO>5$_+YjhR^6IZ`?&aXD zP&*yrQ{t#=GTABa+#Lp1eS7;Yj`;LkOsX*0;YFx$hi@vX=~mYJ4vsd&ggGerpf6LV zv+hpf`xhy?7C>VQHfq|Z#Ps)s=L9z=yz!D}9M#9xID{7hm@6e%+78?|E{};ICAy;$ z(Y^}vOa3MO)=XgODri}dA6tJlmEDdzyohTx|7KOS?oR%TQ$VM)~osWbWbMyr6Q3pAzRsi|aO z*?VLZFOjsFDFOM2d-3bDS>O+UZBE|_Q54i17mu6f)iIse0>?`N_5FhHPvTa2O(r*= zENrS-y}TlcOaU%U`~l{}OAo!`nSdR6o(-{^HQdR+`zL+~KaL z&N;Nt7M||lhsi)z&@x!PRBJ4r_NCU)Rm@X5$O3o1l1?RdczMK8c}mU6pDWN&a3ZW;dv)^5uNVbq)_UQ`qvv6{5Mvq4 zz?`emTG}G_7rO`)yH}`T5#l6@!cY3q8LwZ3H0yjZ&NpNm-)nU}UdEgjdR%{G!S_%p zw4OlIC|i%eg{Vw+{raA|^{%z0tpkT$WxT3)|C8z7iHrkaNns!V+vyLuK&!u4*e|7) z1K`kJ4vLefb)wT3eg&un$2QA|QS#Pr97dy$-G0)C+M>iuBPoO14=j|eqqBxn+@%T8 z5uaFgnJjj~myS=Zm3r97YJ=tCxrU9D)8gxyx@f3nm0?0Mn`y0Imx4VxjBymqvsT^g zWLc|G_8e`5*IJ77Z3tN#OkzNz@0yxJsJ#yP6XH< zI6&6qg|?4bI+WWCfNo)=uFQe$eGXxf#&~rK`4%e%*}FE&)U{W7HE!8{FyqU=1&HLm zylT<=EUbR*h!2(+UD{DM&Ek%!)PCQ8>bRIp3q>#vLBEiZFNU@I0y@@`Qqr2}SK$GD zM0IqzRxb;ZL+UN>`N)xxvzr`7-L5uPXE;5ew)5`*A;jM8=-PphAZ@M#NPluXvG*%VYU>YZ9@{+yIpy(8G;7TUp++LtDzNATm^>;nQ&T^DHzp`6X3?K+GDM=VpDB>Xk;NFSCDk^F z=Z*USfF?NGSb6&c0N@`$=XyG${Ztf1uMbv# z>`r+2^a}d}p{d%I#ZoK2C`-^zO`v{KiVfDs`NVznb4+r-9Ls2Y4$paX{&@nq;HN5T z6zj|k6T4lG;bWDgLtZ9{E5kTP#mJ6+1$2=uQAXzgvxi3QDCDh&Qz*EbhKMHjsTxGV zKpk3xf5_$Q8=;UXS3krhA9ila%#`)g(ZkwyX^1^UYg`!N;g-B;ZJoz5$md|gp z6S9Sbmi-B5#mmbdzsl*@B>HeJU$7GQ?rXlgkp-~jv#^&I*(O!DP}ZbregB*jxK)x?FzI=D${qWdBF3mALP4C%tE0o}htA z0q}aD4VSeExqxkW+m!0iiT$l(nX^6Rs)HyxJ3&(>u(xkCZ0dFvJmIomv z8DYnL_QYG4U3JPnofT|D5z4h8=Fm^MtU>bR=ohgbgOO*5S&O2-Kc4&xJ0>T~0&|UM z)lqR-DS`gHe6nlGZLXY*@MH4Rg}E*WF8X*WWQHdzxfD8bu$|mhFBzAM#OsCz)gHL+b3-)bOI}+z#Z4d_2oa?ek)u$i{^1bO8WIsd8Qi+qplC;~%5> z^ZXHhpRhe%ZX<<=@elS&qh^Zu(%9;w6)OnpZ_5<4&|&2a?W<6xirujFTDQ9^v0!TkD-RMR{|0Xjp=5Ur%9CyqBpW+XfgV%{3 zb7l@xeLzyn7hapPk_A-!?c1_=EWn9r7PbR{zu4s5uR)o8Vj%D4-BpJMs6a`YU3grd>1uPYMYAHYXlU zDC&;mqt1<7AWS52&b58vN*nVS1en277rvy-Zpx)ztp2<<60N2}f`7KMHd!LXM$`1JSTWjW)#wCiP+DK*sLwC;Ip@YT= zQ1F79^xW<@LFa7>rZw_ItlximK;M~}5H+7Y*i3<(R?hB>-J-|rHg@1}n2A!b##I!R zZ=IW1Om4*AE1mE?)O%Q5xv7P8#MGvBtWMZ~slh#VxEY=V!Q%1V%{c5tZ*7DwH*px! zV%Sp(kT9<_?K5Ew(FQnAPcD}CLSd~6`GK|m1^%azwDkL6eYt?&@QaK0WJTp6Ct_e` zU}AE1XXS(nk>>Oi&+-sbCIsoOO&*K)m0vYWL@rl^Xf z-mdi3*+mHa^M{{8h6om^k|<1vpDiu*LH?SCb&Q?Fi-D0>gM)+WH9y>0Bixo- z#$a6evn<()1~Xh$V##;^n5CvgrQJ4mB!c*>p6wDA*ijQfJP|x9hj8aHbbCkjEa~(= zUX4WeLJ#aeF9sC^9{g-vr%}foq9S&jBPu2Q>{kR(w5z33e}pbIc%|0Gv_JBvZK$l> zim>PE|MLb2q*oYtM5vMDfu##+7}r^KLT=cjh3S#1>xb-A0ixLbuA^G)bolY4>S>uy zWZNn=hxoVq@oHnTIu|>>aNY=I?aqiK#D85IxIO@nUTHxpTp?OsoPxfKG?wr{9NRt~ zJINgtjYLH`c9= zb%rx-&y#->YR8nsGr}*XW7*u){*+9NNNzfld3@luB@peKa^i{e$aJ0w5+{-Lz_O9t zbG0Pa_0|~qEya7X_?$jO#~C|bMZ-X7l5ZCN;zv2nw{^u~wX~B9 zsrAR@-oozNEETOz14KSD`KEoPy|Y!gb2Kc2{-oEGnJ9Mqju-Iog55|&u{Zr@ENX6+DMC%YExQr)qc3QPZwVH0xR{Qh zU-5I4G2{p~Z`4D)`PnNYJMupiDWG9rnhZ=M8UWXH4V<)z_?(7cS_&$%7LqqB^=FC{ zt%-PT`f`a)TOK}ao||%|=xK|+_qVSs(UMiAkh!_Ha2&3yDl46?2=-FRDVx8bB8%AC zNvGv;jN?T(Iyj??si8Lum^*+@DuApU;4TA3k31diLsexi)=iBTq0&;dha1S2Au5Ej ztnGHmfkmaOzOeWBPOFJso1U1r8U)6uDl)QBd+?j8j&(eTJsCf-a)CZ#o&v>Y*6XJu zvh3zK?Ri3FOeONwG*MDwcCjuL)CZj6htk%<6|T5>i4B$2N1#&K+QsmE`ou`c^dD(o zK(Wvcrj$yfH@a?ghI8 zu-}W4452&Zl&yAPE9>7D4IETz;7ZI+31MWOa>tQTLPv%!NKW+T^QPAHqUz>Ps$|jDFb31VSS~hkp2&!R1C=M8HGHpD( zocfes8@*}H9ofeN^6kf;b(+tu-X{mdCC6kt5%~cfIJNP0QVqp!i)35T1+uG%ucSCC z7b`&YvN@%5KN?_1BJ}3}4O;mrO|U9w5E?~!uc4?nKs~wLmn5E>a>}NiIFhZ{zBW2J z&X4^Vly%UXDl<1E3%LIRD)&nGJ4MYX;HS8q_PpeCiFsIO0sa~iT^@)LaNC7W3hYF_ zm`$wi(ROnemME`UBW$^+kCO@SJ|Pf7^d25Gfh=~1PdAj9j&J{r3+w-6y7?#KCt(qN zAG?KF*t)m4eG*P$FKs&tAen^inr}OaktcuOdZy9ZQ?S8ld{NS|Vy%M=&H$2L?D|Tc zD9?qv1H1R(KA+4{snlk-+($754Q~7U6wo6W64vZ+FL7FYkHb%x%0s|Ln(BgIL~gqNY?3j6Xga2U-$0kQ zh|E8W+j=9$VQ0daNR~ov?MXel&dRq-51)McUNAa%XX8p-;4Mdi1ytf7p2v#)?yOhF zHb-vTsa#l}G^P;kx;~R}v;MuhFE-oXG}rxD3l(UZ8)jFjZL(E`h?CQ3?e+O zNmuH1y)+iMddOk+h-_9h%Qu%dBUTE{;w%RZ_LMyW0KmcdS}bZ%;)t<|$`dim)|+TWyO+ZT8lV zky#Y}LNE{BIXzr-%>=08;59}*>Efyd64bDKX+wFcS zi1pWL`j~?3WG&mug`tICE=9s&ixamBVv$1;I?mO=evumJooB|IYY{e9cM~ENF_Kb~ zt*Wzgc;=3li?z3aqNt23Bzn7+09XoCG;eLu)bC{ZKB z;Kb4bb=?K`Egr0^kM`C!x=y2U<4w(cSb#IiEi7kDZ&{|13YL#+%p)4yM77=JMq&IB z!Ys`^gIJgjy$4&xU~@XKG^#A+2#}uYjA0}~Dh=@p;&&l91xQp-YHlBbV$pOc42yAE zNH#qzo=LjA%o0iIauIoTU8x^U+-*^Q4Wg~=*)9uQ5f#uEk#MSJxK_3_V7uauoP&F zI#%*V-7*WkcXJUBt7jU-hj9C7I}0Nvl8SQ!%1@P?m{U)LghlM)h4Q1>xCr={109vSs>YgR-R-vg#3xcK?E_I}v4)I`9r zS*DKDuYC8Qpr=ks7*=d}g-L(KL?Fer=DI@@nP5-WT6k)_TcPQkU84e`EDCI~ z#j8J~JC;CuYqB4DLO4BL8{q!lc!2qpi}|TTXkD33o$m3t7j9^F6>+=zS2%LL2>MI` zdbO*_=Q~)c=h|FuknpqE+>WFgdg5BUv2I~w^c09&qg44sn$Nthm!fD9&sdj8sqjgL zAtS|KTEI4KAltIl_}oWzcg=D{){tS<^`qr<7i%%p+QMdXStNYP@1ljWt&s?c=Cj)E zC%Wwcb9L^mr`&TnG*!kFDyGw8%^r0vlXbv}>0|up;_tQ5nD$dM`t!L;*47cI!h)ZaXqA(44%lQ4@R{6T}roCb-BLN z`{EV(O5vv7#q!sO)_MjD&`ZI`7NyLR#K@jV-6T@)3Eg&FoD1Fm&^5mHP+Vzhyr7gPq27vwx)oozeE7%>JM*4 zx%>e6-zSmMAcNgk1eiGq90hjzp*5y`c9Z#$M+*QC{Dnh2B>~J{mvQ}MLFnu@xnUnq zt_AQmj#O1r`vBKJawZ8qPayrTLzOckbd!ywrmi8aIsfH}=m7)>}UcI?TzP+{O|L^q* zd7=@onmS0Kn6R9naB*osw|zkkA!w$S!onhBl4`{R)nhMO%#ssR%|Db57e)SvdsYl%TM!TP57}axlJk5T3aBplK#kIE!RgFtv z2t}ytC{a`Ef#a-La|Bg&3LF;ILG|TzIpO8ei-Ve?El^w8puLDeqdS zsbujuNL*^{AFjd_d);Jq2~_Ir2!5~2j|v_2v*KZGB})nNDCjvHI%BU4qXd7HrNiIt zICErOR4x0zgHTO%bCef%IBC<+a$iiVn!B1p56$|`LYmol{n;@~j@EBB5$$w^-D2S5 zwT!iN%8J<#=@3u=q3f)QAT+{A$REQ&$gL1wa~VVag862jd$TS?2L6o5Hy#a5FCb|U zL@2A@p*7BZ-$1mO6A_*5g;BN(UNs$Ehhw0tQps8eGVhT`DEw9t$iumP0GkX1&gN>3 z`P5wB`*(Bz1v>5(^_tJ6u2k}_zRH85{?E^n`uY)Kd}1l>VNo@AIH{Z5@+chRmZ?_j zW8pdO#cKlF;V2ZmVd+aV>X{mz=loK8@??u(%I^XX&mR>bA49mWv zDk8$)d_yM@OZanlj{k4ntw~fo4J$_)YWYF|gIcV?@3>W=+UVqFDvl^uVd2JXb+h$9 z$>~Ks2WFOYrR%G5E59?hv+7|GRj;3~1btROiwm%B%nwbnavqL;-T%X3YP?9lOv~n= z=_&Oz>vVgtpwfP}dg(OtGn&Yz5ptX7z zlbc0AX!4@=%kC!bAl3V~T%P%=`TU89>K{c)I!ED<6*>V@vIzA>X*|E~7$Guo3lEPp zT6DhkxRv`JDW zB+M^ouJdS)15q=H7NcZC+mD_R5k8|`pb|Np#&_kVAE=|Q!0jIZ?Otf3xl6XtN+uo@ zOS;P*$Fml{Z|Ca>w!pPu*{Mi{{%`+_kxB1D_f+pBSrMycjwLrGbmbx3znZ?2%k>nIg>9gb~}7N_01nmz!+*Ci{hU z#fQKD5zKVK|D&L#x`q3$8mJr*h$^a!nluKDcrD#zeEa?gCD?QxsqxMFWnKCC38 zMsRs)>63F(l2S;BtjpsRb`{ij=%yVV3^mRKw`HS~T^@L|*E(M+Kz>Dyyds&6y(!gn zk#S#6?~2)LbKX!P6|;g!d{fL-gNGNCp(=)t|qNk75t`(lm)#o_X)(Y*6_wc${%>j39?p zJ}Q3DelFrPMj`easP+?P~Dey=|D4o%&$B$b|G0mcMxeiff!{(_D? z2Kvm`@sbZg5b=nRMOAKy`O0*dQoMNa;14?i{6}Jog$T3Af!wY@!LU_I#<$p;+>t*r zZ;TjrWTZT>Js{j1zv|*bmpzg;ISCqgRhi8Ew~ptZcyx9-ws*b7AE_>b4{)CqzV86< zzzF|8$^u9IS2QlOqa!i4p;ser0-(}K1`krn z-!=N2W$}okKpmRb=%?+VRWnL}FjMfEwv3`C0FD$95oy|&3px=EkkN1p<-p}}&E~*O zHN4c0I)h5#IK#h0p5XDs1~O(Xlzv-RBHTH9dsjsCtz;XI%Xi_D<|m3DoRYf(&t4kP zltzyxez}#sITAJ24J9Zkbz8UplN~pt7`9MbPkPaXCJH!Uu>4J@vTNhMO+BZjDz22t zuGIh~iW)8Tf2nO0rpx-{WyQ75s$*-3qkZde_4=9r;hWI(iNlh%aiQ8?!Gzm75<-F zl%8ZFRKXa^%OMylIbFfVKf1eLfr-saG;ukC%3s^WfQZU&4904+-1^BBwz@>rd1B)- z!Dbd?cq{*zxYWf;UxdjM7}@&uQG!}L_TL=_KV96w8uE50k_iIxT+z*tubu1PP$So) zNn7FRqCFOce2K+VE(2s9jDu5qW7r*gm#(|xeua2|7~LZl@kI5R`O5ElgKlrsSNo-( zK9COb$7|00^K4|8dm|g%PD-q8C@py3%j*h@0AwF)@0^aq-w16b-X`fEUP2CXs2$L!+cst)8 zXqsw2y`~C6T{o4k$lLoHhrB3C`w5GNFud2R_yYvwcZ>m!BvRfm_JgD51XM|hY;moA^vjZOwSTl$yUrwVVcYS`coWX6kQ<9+)r z9^1Tewsl)Kc!<8IC6&5(so5}r^=McPts8`pdb6gx+a7c$|WaGWA4=7ZF zLMdNyi&aTw!wF>!=P8vpz)*zRu&ceBnf}8!w z&qlGq?Po3J zP+(SPi{%jhVqtvsxN5kTF5|zj9Qf=`5@9|ULCa0pm~~+6t4QP<{;}xzV)5l_!VFDR zzQhrf0&na)g7xn`jy#=T{)BS>@OX;aXt6&?{j#t`M;{ew={aUkE?M`)2#uTaJ~i+1?C$3V)8= zxP;GXl=5X9>`aUY1cxNhbws4q4tC2@VrOYvuk9j*bb5iotg$+-GkDS$o|iUI`;RKi zg`?>7`f1OvtLD#nTN|0tz&5`xKFPkkTJnSTGt+PbAn$M#friw&DH=s{o`gMakaJ3yq3XHw}BX#?2i!5)ist8lAtA0)d$K~4Y(D3z(0|TgWGh);`zIfN z2zmO`zr>j-zwg4tk@2dv_UG=oxq5>IxUv_+>LLH(i-?V9NOa9V({ETx<0r&R==z6# zZST!Mb`@v{MAr{7Wl0A>PMm1#%_lHDa$Dusdl8+{L`O<5ue`GgH!oXF>Qcsnvt9p_ zMzs((_*`!t@TL|M@;=K7UlnIHSnCLJ;FI8Qyg{0`Z&A)gK}?L5Uua^s9FMv=S#kYU zg7$kyS5v1>%VwlZ;G3w6DGQdY_F{&q$wz~5?0Xo}1+ znpKczvwlb+w1;-af69Arap$`8aEnO7p-~_?HcCy)ul`rc zD6#2-77MT^OSyfK?t{cmry?+3Mf!}pNoO`Ty1OT#>{D)-*git_AT|5O(Tuj)lLN*| z%Er!~Krl zFf{+jhJw$&5K1c)>q{Vm{gP*FIlhWHy+-=qR)23FD}?R+3X_RQ{T)_Td(Wsnc}Qrh z#^VDSQUFk*r?=n62*iv$Zq(a-z~5*~=9=!bF?7Q}f;0YOWpfx=6tim^oZm@;#*xIe zN#aY^lBjuaBEeQ~Gsc6mb7Q`QF1GcRvEDV^u=snbUkmDK>eA*XP;u2)8S9PB!*Y^N zpWmb2C>sU1{VzSHX=HvfFZR98-AL5bw6%W6M!BJ3rjy5|fHrz}NZ_yL@Hg$c?5ZJf zIED9SZL=ruI_v!zjF2)vapWk9QKFQrU21Ga9E#i{w@Fmqo5=nV$(+cEm zv1E>P$H;*CNdm)n!_jIiw`Jxl*M@ej@p6szR2T3JCwFXBQcp}995_e}!wL#-FN<~H zj48wWV>Lwm{KwxD;&K>k|41vRK_lqAUhR+ENh6JWqEeU=qJ|wHH7wjBW7*tTAEzW1 zb07_WC$T2biKYu=R78J#k9Mt|n_UZaWxpE!cSs`W7P3!ky}98(1Y|)sa(vPFyYP#V z+{zrD5H-qwEdQ2r)5=vu7p%2Ld3b5M+-M7-I#-+hn-J?@+`OC3Rn>5~m=$7Z%=z<@ z@KL}B)8oMRmey(;BJS_q@SvZ&l761G9_|6n{UaV-EOkmI4drQ$4D^bq$`O>TdeC?S zyUVqnQyhxWX9?X_mj#1|?Z%^N*laFLy_uJOOf>}1Y#9sFP_KU*j%u`B$>*{(7zeZu zGGDNX)3S*OC~Eu(0Ks&ePPU>Ck5kOi{u;$F4HUSY=)^gNdgd5~I48B?qB@_#0G6+J$Z(GF*vI%(?XUnNBMoK%1_*Sj30g7( z^y(_f)7BL#O7;MC-vDJHamsi)eg1KSR!d`;_B~vnXxQW1!+!ts%FJuYV}s2~kdT-^ z7~E$nQRun9-AOCh=pfy{`msvbYvg7O%I?4Ip3hjV)@5MFsbQ;J#;tlVWlm4A#jl9u zX0b7X)POVC`n)Y0BZl#rZ(*|Z{7%DhE_38Cce3i4Ze+<toY}1k7V$=v@B7B8_-@Cj{dMFc@dHpg*9pVE!6lWrp7KH4(ZA^m* zU{D}gY!P}nzT=bHZS-~hqDD1YIIs1+{V*N&YA9% zFNgelgibr}G3=5sBz77MUs6y%mV5!7miDKVu0{Q8hfZG~n-{WuCm}Z_9+|C@y%~YG z)|q|E**R-0_c;_~oM0+%F>A zN9g*jOMtU=$G%l;EfVO*Rk#Qy?O#*ahRJNbSlLD0{4KG8}!D?zLimA1CZ zsal@CYQisOLd-B4betFXyW_w%gKT> zX)JO+ot6pLjJ;%9Uym~U*vbQrm|X(M^{;j ziO*~t`|$?i{20!b8K|>})iZubB|!G1Hy&7$m>-Fr+lApuG>rs*i;5w0(_<-4@9JaT zQ{EX%``w|-HJmQf9X*{vbz54{zCh5 zAH#tym@MEBFyIG>b{d?Z>ZzczizREQ()smAV}gKZzYwG0=EChZUmQ}$Ovbkm5T{*{ z*%|cLuze$;n6s5+;_B2x*9(!%_F%SAh;YWreB+lMb5@-kKeGs7xku5D-)<>C)(~EO zj|DKo{dcq|MoDunE-rTVMlgY6f>El(yHw^?NlGNkAG?2jU6q{RIJv5Ri}ilb=RvM^ zi|oRYz-moVXLZ%5S>Cs_hMoKRFR7&HzQc~j*$Kkc5sf~xciz9$9|>~^SEJUa)oZL8 zO7#!-x~0z8PoMa?uqAV}S_H4qx7%$w$5!JGmyu#%+08v;eOo~HGk>;KNE!>bKb${y z>xLh3&`i^dq2n?hv6#-vm46l)tc>pppmpG+$V<%cldq>)Q!n-S8l)}R)pd?x{Ds9XL~JvZ9oUrN~~5eP`ui z<^=tjZ^x9Pi)jQ}z40GrTYoMHA(v!^em?vxp~04KG%;R?xnDNdiI~2pWVys=jBR|1 zs)whdSX*q!KzIOJ<%?FulZis{oIkO>aCQMtm1=K2sQb2WrE{PYP9sg#xS|JnGHZ=@ zo2|b3=8DlH>^ost8v^n$xxW?p0TWX=@w$*uDSjdE_h&hS7&a@%s- zG{BQ{N=VpZMdjNa&&fVbKebeA_tdX&BP|+mSV0}}E1TfKzt6Uj^4ydDCaAZ}__!=s z8BKc}ImCGV6+CJs$8~J~wl78Bkta$xz?UxGF?bZ}+2TEQY^jOQZkJtsZeP zs7U+A2X;LN3gJ1d)pCy#OO=HM)7vgW-ewSd)9*j?Fdj;G6Bz|uNYH%NKhN!f#C#Qf z*ggN1c=8_DDSHsJy&UkVbN~)2kJRG@3>(p!rsQ{|OT9q!@-vRT z{4T`G5>osvQ8)%n?eYIn?|x`iD;#C3PjxuYU+t1{_ijnk)Iup{3;n4>|~jescQRERWo30P@lw451_C$Ky_Z~8s`<%Od1Y_y4V z3U#yF@cg@S-+vGX>iDxY+C8|ml}h%IwmB`fQ4P-=tm6eYUi~Pjfs9w*wpRBF!0U5M z7F`;H0&d;SyI?PW0dqv5Za;j*>Y5Jt?*US>4(rLFc zPh;NNx0 zx_culirzza;C|P3Q!Y45+!-G~sIpTZPnT{(5J6e=<@MIq~KFge|v^-9oTLwQ!t50L#~Aas(kddo5ZmruUw!%Nf! zyS`F420?eI%pz&5@GbNg1M`R|U4mhOPb-z!Wr`&&!&F+jQb9*(xUAZb4K*KaSIeH1 z$drlGF>v2R2YQPmc`$xjjyy1E5WOYPhYOol#pHUif9JX9#WeNVmz!#a%lS31*S&l1<_pPX?p$ehKKTHQ?qL3X7e(il|=sv#ft_zKw3w6#uw zQ*#OWyNs;IJfUsucF7kg>6`UCnZ|=%wa2pvdg@C*sW<`IsvhkI#`qPkHalxSiuEx4 z3xF0*`gyPH_}8Zr*Zb!`b=%X_Q>X9$f;Eia18s#o>-eboNFiM>5@t3+|NYngA}=Mb z0ca0aQQbN1^WzE-7F$I#xeIeH2=YfSx1NMJ+4{X#!+sdmQb|r^v5f?5QWJD|cY?UB zA3T^LPv=@3uHli@VvJVCFZ*&2RGI7J)&BpgNE9j_eHHr2_lLUdc7`&DB!|fgyPH!_ zSN5=yDp{7mf&y6{b%trU?v(&YnR_4ov=y(vjIt?s(y@>uoT7Uq5##}R_ef3a9IQm! zeu|SRN2mXaIK3`|YP@-nt_6RleLv&vygmKpv06I>NjAbd_o=oxx8clawafWSeR4dO z0)67$_qem?jbSQBGNV2zfQlIT6*f(q8&%&#m*Kct2dgog810i1zdMQcl;;Vpney8@ z?U@CeF2?)_UE7AQ4(W0tud@!_!+z~C>7#&BTEbOThn(|sQ?$OPG%f}i0;F3M_41M|JbpX3hpqvv~Ghj~>N?cnY6Csct;lue@0 zA{#85=(+y$OTk-_?*S;Agz?%{(-s&K0rwYx7`V&lV_t<4*8+o*c(~c9 zPS=AECj!w57d& z$ckh;j2mQWBqP2bP#D*G)?JP#Osibg zhl0Rj8NJd-d1i_;Cy%SspLdT%B&528ZVI+d{u_ccH@sh!zke}t?=nh2tCXvBD)9nF zrbw|zD)dU{9pGgTzPDFM7Z_*$;(?ej#IoE`mz|E}5G_RRYR*vqp9!g8`oQjirV?cA619EL=cXYeI5+V0@*Wp<6%aZl%V3XE=y>soEk_=#jsRb<#!lc zJ>ytTY#jWOP6i$Z*}zP(Dzp5hPRV|Dr#n(B+5C)IQ79J04p*HzFm&cJDt`R+?)qpc`OHx8^0LFwCdTOA zcjXvPL|S$dTdlJA&QdI$Yhv+rG_( z#^*-d2b0N*tDQQt^N~jmZ8OcPPDisR;3B#9qLlxSs<(`aqwC(h?}Pve?(XjH8r)qP zX&|^;<9_4PxH|!YyE`Pf6WqOVZQL2&ng27-y!EA4ovO80o$@++U)RsGr0;e{eRTdp z@!j9RTJ(&aP#Xo8qLV}T*xG8N88Hb5XuebLxXjy(-u2X2^8V-h-J~6>`@+_4F0kv~ zc&0P55`QJgLD*-y&Oo20QqaHTb8604)~RqCzZsE~`)sPBy5~RAWlkkeVlqLEW{eYK+ zwxa#Wfx&8o&uY3s*%Mo#v!NoKM`!lgpyWkRO&a0(+lHdeJNdfLec{j|AfwBo)Be>b zq_Pn*o~*rsS|qy646ky@M1|C4Sb`_@2xu-R5%9@Cs!O%H}=&|Sih&+{FBRu$_=_asn6#kWlr_HGRIOR(A3X5go+&kF$33U6CS(> zYyp}Q7+jOBM~Siq*N6gyDAUydBe?OU2abg~;gpMt-B$0Nf`&`6o{LhnmS{L)pXm-u z54{^A1;ysUaqFB^<(L(YALB@slVwgR42<|Cnr2`T#iC4myrmv^Ex}6T{lSZbd5oc6 z7`nU_umI_jq5d;|khOkCq`E)u2L0%oF}G9MJ-0d0{&f8-8ILg2aQTSa;X-*5hVpEq z8lwBg*Ma$2Tvl3r!+8O)t$Tytk7{RE$`rt;hXtCi1F|Xa=E2)O`-|r`$;PKoCPp1P zY^^&dF-Kr zai=Ae?PL0j9{Y{sAHP+WIOty;^3Yr;yyMztSIE$i1S1mUxr{g9{lA zt3@>?{8MxV>u_FI-O-vG&~ZUA+Z7C-sE*b{k&|iXc29QY3u-YCabiv8hjDJs*Rwv{ z+(F0Pp5+^R*1(yxEAxt_*n3=6k@n=pXPyirZS5uk3n7$)Y%~{d@=^1ETX@@tkVSrVcPJro?g6|0bsaQS_Z`PrEhJ-kdU~f0+`SwHafGOKZ8^9wkf4yh)?x&DGH$ zk9m=pZrPY3FRfLj>CVr3+Tts>h@o^O(g%jP6)tZM!`xy{hh$K2m+9QGh*dlBU;!)B z6=Sba#$yHPLvk3UUp|!{tdX=b)9&Kv?dmwea?tEMpN}NblQVWkA9J)+$orwRF#COT z3vqbC)~EEWW>ht2ch-%c}1^GZLlSMU)GS+y;a`(-;gkiYF-|>MDDo!~jv&@|4qs)UT42*6h zIEI3UM~(hBM~QXFHPm??Gs|i~H&US?!XCpJ#FL1|iqu-zfKg2s8Tpl(=1+8Z9$FDd zfgeN<7ySfqt7$EDf_5hTCCHZiRCl|IPeM@H&!Fe#@Zeo+#h_Y?fk9Mh<{g}cdhQMr zO&yE-N9{0LJRPAg5sOgS(-lLSJYp~HVF%Jr{jDp3sE?j)Kneqg`6^QyToTu^DtHtbhe9h)^;e4zA%|aWO-6sr)77)KbXZs1hRv>izj_G?~N&^ulOe+(jE75je#<^pF9nsAoo^=%Evn1HbJL zCf&GBU2g5L)qoYwaB7A+ENFZ8NLf5lj=k7NC7Y6iN75IH@0;e6MowKJsyvC#>`dyDx=Cb!jg`ofJv}U{047bJyO1Iuvyu( z-wN6MBHkB=j?-)Sh0%*Q zB?&tTt$_Zzjj9bvfX^G@j~yeYG5nCKWjW<@0Kvmdf(+Pout>I~AA?lc>DM=06-RPc zqGWqWc!qYBS{dC33>$-sqsFE-3Y0)L8mg9xs8GO{8tu`Uh$1_itQtT$2WcgoD}A z+8EzDmSkvnge^QPxj#fJ19Mj{ak09E!JYdNC|8#dGW7Mizy<5b0~f(qFlDuBf9R~i zf12W5CP9fHG;VXpPN$NhIYsqsl2#$Q)*{wCULcZLx{M^p@%cX}aY91pNiZ`>D2 zDX!`AfuA7*)K@!FA+7R^u@1eK%VRSNNQLW~ zpi`eeTT++T+X$msC~UlvgqMOXr;066lHvB-{!kAa9tV5?hNa0v?r zC0Chm(nCkLgyI#mQj@xrl~zN6-$chyL>Z%&*qh_!(3iH+tcSM-9v#BTU-p3j;&=GG zm%v=Y%1XTX!EVXDO|!o4!pcpLkn~p1J?_HO!BGPUG^Ag$Aapn3HB;8~$p=m=%x@Si zY~1?u(M)L=$M^nsEcBM6rDk^YSY393VvFIqNXT<<#=_r| zM#s%WJW~sD@fmir(M8B3i~wk2YjCZUKaG6vjU4*O$pVggT`R%PSZk>C8!_7Tw)@-` zx7HYXHiDD1Ne7SMuEqkLTkTcvRccnHGdEIGwt@Gq6)_T6m3|k1`fk)SW7Agsoby=# zJ@-g4^<}yJT)5f8@)72G?fUND-v%1`^r2rX3i%>GZO?`0ltOOX>(O6)NOS*D>w+Ye z6mV@hCOPCi554o%`sTB!3j5d-^8fL4WX$sFpOtegpA(Ws7tgL>#H2L8Qrh^KUax+Z zYzEu*?>iI#A(Pp;a4GVy7m?1`DLudQBXsnPe1~%mJ+n&RkOQFv^+eQ^mQsN>_>hra zVA*un8M~(Dn@qxHqn)6uJe2g$Hu^A&i+Oc(q*L2~O(DQ&5V_lwD1X)T;!u%($Wmvc3KE* z_I)R*2jbmu^zR*Pws);YXBU4&g#CzE`ae_WH++fnOZ}SE|B5Fx-*n9afd3Ige9Yg` z%gO#9ghO0>9rXX#fch9fKO9ie;PwBMOd~E|&lq7qK*M^$g_N}u*I>hI zj6zdQvNE<;0(E2_B@RIg0722hSw){U3V>12rTA4l{g&LAES`FY2_A=V+MkQvM>;5c zZ6P0?wyq@7wqCn5|LxT~2IzO8D6Jf~9v5^fL*&kOr;{^@5r6_TCB5Y1$n{B^bmrv} zi!g9@%K1b~ODRoDyH^v;mtQzt+GsXr9_vjW)kGkE4urg{vyl(qnzZS#HalaS+?wQ^ z`J&(v*^fcYxDM^cU_bO4`5veZXRdgU*L##X9!Q9TQ`?b)KZ&NMyQ_jrzw;5?@I^4j z#(@EbD8qlTyTnKU*_>X2KAAbuv7_AoIZGb}(JngE{{?4otm3|jpa{sAR99OrNEu1r zS^b-q#fX26O*O0~u{8VRrG9^4(?I3$_I2E-DT^>|(&=T6m;-lg{B5tI)$Ja~$K!%( zDL(hqS||d+Kgvawr0yM4`=vE*Xi=r%`O>-ZQ`@(zzlAM>b(Xsb?!+P!MGYlwB*tWx z(gBq?V2Z}V-0TB+NrKEp7O^MSx9pWS%2X!q%NU{Y{UkNWR6^KCTB7#V6)E((wch9T z8z`;f`@a>zOYZn5?%5FC0>tHpFBo2KqKMiTJL4G@d?m_pHDECmp@+2iLKS=|>b@Ur zOKJb@`R`oQw09t4+q})-h$y^&9YCks0#Su>hdrz65XpjtRQUJ0EOH3YjWHeDROZN({-iuugq``$-W zsjLiKe}wTde3&k^Hs#PcciHNNq1N2fdTvT@NdKtK4H0Rb#I#3yoN32|o(j;i3ajfu zObypm_iyivBi!JGQSV=W?`N@a*{g-?ukO3-y-B1pt%?U`R+Slby6*6 ze=rXdvQI_idwu;_(ltW(1j3+B4hVejorf48%6*>*Q9AHGykhp!($SIEzP(J$!`1y7p;)D)Ubi4 zOh{-Xi8f2NRk2f;{WHGB)lRQ+u`Lb@`v&#=UWJ8CuoGH1&meZEu(E1O_< zMJLwcA6%Br9K_t=kiV!fUGaxPvcs?jpjVX=A7^I3DA_V%Hb_BJF^DsigHbVHrtip8 zI6bQE#JPiZ7?RGT;QSKyfDWer)bn}%5waVIb%SI)lyGeVFViNic78>qR~InKY29zE zxTAy4dhT*I%B+rEqY^m&squ6rbd3ak{P9I&A+v;GQPQ8%8b@3|%FF8t;syRN zR$K*bFu`_eUWm75DT!wjcFGJS2R zcyj^=TmT6T%9PpFXQuO$oP3YZKV9S%B7H@G@ucZE42pN1p%DTtVWcf2TU%xD5XRIL z(~7hP>jRQpotfFvw{W~F8eQQBh2f~MC$*B%=jcjVnZXDU367YRB$jbPf=Sd{3Vl?> zAs$AeVgaa1i{^jcZ~b6;wTF<+ti*mZRi7tyuc-v&2K4E=&aa5HR3D5x8BH#9c6O?a zkc+=Z$%D)Hp~5n(`S@Jd@F$lR+!3+wrlf50dZ_EqZ~vaowJ)^6UFIGigFKkkf> z^POU&CD+!c?ge-7*jmZqwnLOm5~pdsgHamN7p>f^D(h2#!G;&#)lCxle)4svr`?7; z$dt69<>dw)H4*8xM{H#)S?TrW^-Jngi=Wrbeuc59(Hss8GfUg&xRDa!su0Qu4(1Dw z?5C>WtI^Kp{f3CLLty3+-fSCh%z@(WOh!0pfAmrT0)|cMU*3FBc?Jf$B|lW9xJg(@ z7L0moUm>duyN=PQWMgYZ@1_?_|1{FQiM)ALcXYHBZXcebSW6Kg{r=7lW&Ihkq*O}A z5ak*n>)~X{k~tYW6H&8Ddu5PhSb5s{eMsUf(<!#8}2%!W|LF8L%JU10|Ame_oL3F5=^w zU~_fjDWMB?0Eit9puL-MVLbqBY}fW64uML zEY&8@4wn0CO##68cM1Z|%BHr;&DNYCkXn(x;7k=j^o5w)#{At!6^D!gEI61boWQq= zSBq>n(q%w^PzQW0@u_~N|3&uhfrgnQmzjikCd9175&$RcGi8Q0^Edo&M{90pvbM5z zq;l0uO2OahQ6ye{mk)_ywZFtH!jQo(j8>26uhw7D6Ywgv*Gtw~5dh?WwFw%cwzS`# zbuEc5AZ~le&!HX#0=$g8<`Q4g zrs>{(#j?gdb>QbvCw8QF7MOIe`la_-vR1eaO~e`$ZKxV0Y^r*E#WFUerTQ1W;JkGE zps;r6cW2HZq2K-rMQ`m1OlM?ATGs3jR?1Og@%T*a z(%r2n_Ajq-PuW?4<=tW$9Rk+dnWA#f?>pwSrJv50-+!M?xMM5i;k8W_P%zET!}9U})4{A@xIX4HuDXPY z-v!&YT*K-+Lma@yQ+DCf6l0#q7&dQCY;q?ks)9CVc&_YmFF7l*3&?(f9+MRvgis&F zh~9oeV@`o&iHa-D%khmIn)nOsG8^Rpt3zW*K`oR&rI{SqDj!cxy=S)JZXDRE9O*Oz z&`eA;A~$PJDCheX*_xW^Kwa@O`=+=2c^)H0T~bk*pL%bwVN@aIL_2+@PZ}YLQ5Ms| zTP?7^7-w_8=alvZH$^kvD8EG3F|4boY^S2&*T2F?x9H3CfSFEZ^HPf?o=Q@FLV1}iws#>g3Q*4Nievl zsj8zcr`7~tg_Our-Q06zgRauzVd_aKBhBq@;)+QNH}A1!<@?R2AgZk5AHja_ioLU@)UWYUlAI|TTt{mlCy%Jk;j-kp zg-2Z!@Mdc;(;ats-7`=uEVhm8&0{l0J$s&47&4UE^3!2)Bsl{ZMX{jT;IAO<>og3x z8cQ}G#LS}(S#czT4r7Gf=KU_-#clJngXs$w9bd*uc=v||Um;PLHYoY@{3|_Hc6M#O z(245v;X(4gg??keD889{)Lv+P@|`GWp(9mg%W2j0rhe0HjJk?Js9(-8X8w{`*HppC zY5~naAhG$my|GsoZEbv71#G|i4Co}v5WS!%2_+N3&KW33^187)4zu_A_O9<8no~DW z38vfGaKaVI4hY+$PXVGc9~D~eKJrY(ej?`)$H$uSaKMUrxv`7pv{W_F7twReaH}h_ z6Hb-dO(j{Pvb_4+;tW)oz{R!}5hmzJaOO_USI`J`V%h=a!rBKpxDBP^T1?+g$VMS! z+jXT+9_t7PpDbNhNA#7?Axv)2_0tX~*gjWtoQR{RRsV8oT?&k4F(2Q^6%Rto+#|5< z9Y@S)0dxb!>v=XNnrrEz=D5oaDcO zQA^Nq_9J_$!e+y(ujaNtC(a@+;j78MZ;*$WSzP}1aLz{GCS^unL~id&$<0k1=q4hR z4iQB2q7O43!yI9xGo23n0_^Lolb5xetRuQ=^d=I@VUwi2Tzg|eAyuMTA4}P<#>vK5 z^m}q5FWb=-y4^$0yhZpiAJkB(1ej^~Drm`Ep_0n^vpKAd0y!!4a!P)9KSpC9+Sa6T z;th1fU)}0GJw9Jr-(tX8tbwdgRPLrv96`TVhkT^ya56f_;_#(IPi^WX{Bhy;@fp12 zN=Zc*A#o@k>2wL^TP_LT((=~n*7ulyj6Qb>wP9p^ud|A0RF|ax9)Mu_$L3`Z8>d2; zI}ETn5ouS6IX^<=|JZJ zrz;*2ieR+k2f;*NZ$wK@B%;;MT%uJnaiNMUSy)>D)8JTB{8~JDV~z3D3aTNw3RiTM z&E0n3Iro5s=vX$Zwlic6yVI7tPw90_{ZA@(Ufr%NmRg#!8qosy&%`TTl*ss6%>w8K zNW`5Lvg@QD{sV`yzT@kZghYeVF2CnYnC6dAJlxwP#9(#g_$zHL-i8vk(u6?cpqg0%r@n~g z?c^BM2H#LyffGrOX!N|%xW#?`EK#>p&QG`)=NVeggV*~AhUR=O5!k%_7-yE~t@XGx zr=3$Rpe;}D?D^eBP~R9X8s8D2A;Bv6?o9A+odo=gVh$raqb1b9i;@WQZrXSJOS#Cu zhRf}GklXcaKHo(35;Pmnbq8>^)0Iy*uqmaFx87>~SFGm+htA`~CwY$8TASBTAf&fB zl=jyOP;WkUwu^6c%_fmdILUp&>nn_11O8H_5pC|$i-Y0n z0Zv_KGGfLwd64{C8S%>nF<3)QcclF6dEU_89LeP3ZlbNm2j1-^zN=IaNJLzUeHz!1 zLOY^(@N3 z&O05W`B}}1oO9-7Z-&?9*F-Ui-ziefVkCmuUq3%>2Ek=>Fv7PbDIXa3IZ>MutMNCc zLq|^dz4B?NE#&W{oP?b_|DCc!<9)*}Iuw{otR4=Be`GhV#sVB}DaiLQiqX%roiC`= z1D%3d)a-}y>@Nn>iwA3{?|B}eKQeY^KoppX)9Kc8xzUF9S;n+iK{NW*H>y^lY+53M z3*V3nbl3Gn_0!+b_Aq~eHkK=R6Lx!n z4BZ@Pnj=5mT2B_xhS&097WDYURGS*%#1u=<_qPV+)*~dSR}XXzxYuzTLK? z{tVpXmlk~?nC}566QvJ1fJuawM#dmPR^tn_ik-AmQBISGHq#yY|I7+_?Ec`9Wbq1d zCe1C@N^8agVTqN_?a)UbKeM?j`Ak>iM3V|dX_~6?mTC5wFd*yauP32g{{9iF-7Ib^o zF~QdF9%W81H8osTb#}w?yXBUlij4GQ+s{hxs`PTYU@`1jRz^#_HYX4tR7Bj)Gk58GDT^)0f81`WPlv8?`|lkn%ub^MW3^%`+v~<;Ri6>PtPa0ShjbI07hRqV-Gjuq z8c|6_=#E>zqBo1vU-({f+Z#Sa(-K1JtdgLDx}yopNZ!}~1fL&CCH+u9$rCAR2PAks zV4eru5fZqc#0)i2-(+02IVl~~!9UkAtw?q5l6P|0{bLD^d2`H9=GKY{^_?tP{#)5R z^Owoo=3Rt}kGsI~S#^V8K3rjkT|if}9#S#zz-yy0^0tWIb;$+EE;j0sxwK&&g{}DN z?VeK_b~h4Ctc!Uj`TnM)^Rm^&Bx3aaEOSQ~bW>oRr9FrAaJ}yzK+6vsS}vEIDE+5< z!_{HoE910|1`WKb#j*M^O3spl9&dD5lXy8mMHIY}L3x#666s8SH5Kru!!#nRt1FVe zZP$v?ZO$H}AArhbcJvU&6hQVxCCR!^BFA9aT_EcaeB{Y{g{`aCs;{p;yZnG>3#*fq zq&GM+4swtzy1Z+)nvBrn=#b5L9n2PxpQ;H0!{0XX6Jd&*%`W>6Ho8bqGJJ};@){lm z=Q~hG>-eTbW=WOVly2FT@#h4^d@eCJu&f@!i5mU9R&Iyyrl%E88Z)^ElrLkTv&%WX z1QeP}GxEal*54c#sJRJ83maNPANfMsjMp0SyV6oIbqBqU6z0_%Lw3EePx*<4vh+=4 z=d;wX()ze<32o9@D#mXL$1_b&`53lKFMICeM|zYc)Vx`s-h!DK0{V`)y9fl8lGFew zrH8OjBEunYk?t$-#OLSO$blYE#Lzz%4=h9+MGe+c%OIFCfR9;J!c2)RWevdDldqmE zuK7kGj3h4}bwVGU15SBn8QpDc%?~Bq@ibL{gUip`#jJ-ST=wD-?s4YTdCZRYo?3Wo zN1Q})$oDv)ns|$o`B=(~HoS8Iecee(915^s(hBHj-esR~S>*Lkqx3$cy;~LJWp; z0evLG3HS+UZ5Ap=Fdcm*&c^pT-Iqc~D19*WN+@@IR@mPw`j(bfXYZjIH%BX(KjKz< zysa4JOQ-#r?5_dr=Offe>2FkTdjo5ys{3wU|OG$+1qaG8~2UA>?WU#o`#@% zk#xyE0p!E!{BAw#n)gGuQy=AD0exuaUY-;@@I7WNf9bW7aj|z#(eEfbJkByubrPp@ zJV-ATf(QH3`L+A9RkW|~p7k?2w=@Joz;I8(_R~5#E`HZ`%8y9KCPVFwr+%acqwegE z_fuK08IdyP=uh!ht&N4R@#vnvvdP3-7opCBJr0bSO{FSN&2dV`3;E`G`L1P4Lu+o& zy0!XK&lk!co(&E{@3Jy(pLjxPB=XGd@|qtyT7Q^ZGuLo*pu8GIU+*eP^7fU?|;Vel%bdEhtYCZugc&zaHux~`*|myvW)WPJVBc(1sfDWz|*;W#L$FJ-Ld9Lar@&*aM&0;i<%OSSI7k>Z>>6yop&+G=@tnd zl>{T`1x+RvsAeN8D=;2wd;U_B6eecs4SgicD}B2zppcDHk-RWUn z+aZno)bg`SWL9&622D*rzvT_xM1>=us@x-+iX-0+p+mOV+$17F- zRcWnoawX^=LWL*I4u=v_U-m|<$Rb5@9jSTE%;O#!%f02&+q7V0v4w@`BclG9fgDMc7r+)U!>pRW$7*-zn%{jaYQIlX+A$0(@DP|N2Ru>->^s78l#K$LppG%lm%o2&Q zGWv41XB49DyVyFf-s6LzCc7^IYhOy?z!ZcZTd-x(?*dxQDw53W9VsEKVQhJ3th zKJ3>iX-5W&xi1uI%>ZyM1&?cylv(mJhMkQS{oc=%D$2#XPVrrGM~;__MXx(3`-2vw zylZpxWlo@q-GeGZDBItSl~pNcG#Ph8Y<1sX&wDL*5ZgS}mH3(~DbFvrOvA|J7<^yo z>X*IV9rA@!1*KANaz=v!GE8lU%c}VbF9Nw`|1_TSh#{Qyc-_CVitQg&dh^*a6RvHW z@yf-$8+uYpM-Xi#Pfy?0g|?t|TsHk;SlsjQWhFhP-wa=gYSy$`BbRUj-m$YE%&K_s zW#VXIDF;Cc>R1obGzM}DF&P!y`HFW^$DDC?W11!C2u_6;j zfx4eT717~=&TuS-r8k2&P?cOSd&mI`L`f6s#mj|MzWX~uIS?p7I2AdLFqtDqE{^4! z62(@vP%+c2!uH&<@w=t0?oJyaR6S>ST(`{Ei6RaHBtAcneQ4E(s=ClxI7S}WsH4>6 z((PxspNk*bgj#iUk+ny9(u1zR{29RUKuoo4r^{azpVPlY)`*o-6+A?aH zw~&G&YDMRY+F-do0&F&5)Q0zT!0BOLjM8zbQ?*z1TGG08T90iif;Ft3Ja(C!WF%uC z*W#jaV3m&!tqwf-CU?xl)H8240F1y0VAa@v!}Nq(EP(tqOpYr=;0N%aA8ck2P=7m} z3vGDH3iWM&5qzof9b#{wX}obaSy^?wo<5CBe;+UzL=3D--`8{`0?6n#{OoMR2zR(h z^t5S1quwFLxG(FBLl$t`I$m&-jx(!!6Q_`XyZNK;ljEt;cPA~LDxjg1M1ySo*B{BT z=bgO4a>{i36!&YHMWW4yosb{H-SyK>0}U>phY6|k-Go!bvUsu_)7dg8eL=VbV=MK~ zvTUKgU3TJKN(i^TTueMp=k59P_?s0EVo#>TBHQdD2WDzB&klY@VI!>MtkkQoUH?)% zK>g3k2YK;!u=}ZfLLZZ0Cb4CMJ*@4=cKD6GJ}J2Vgep_9nPNbgp@E#v1(DHZ7LcE8 zEuT)Hz&OuU$UyTcCtSVzNJ%8J&O%Z~H0fkr4&X+%uX2!+C+WGK%c!}7x#UZE|s;d>90u(@A*Ip$%F>EuH|2i4G8Mt!h>8XKnH!`<41 zO#985dVleh@o(Rw$kPy;#jd~GtcM32KG;FEujkH+jo4DY6Qc$~;n1T46F`)!aU zIVDvs-S*UcO27+eOxoaZp@iF#$6kG%t-nr~Cj5CwB*JooU2?t{LZiGz8I391j*(;0cdS);Q34l?x{aFldmntlH9IKl9#I0 z5N^>|6CQq7G@~h*9XpyAj;^l8d6>KGuc`d^6om*c->ORpMX|07-5q zQLUX@pTq&=M8bE$bRMq7NqNXhgkA}G*<)qD5NsB&e|&fGs4t9pdv1abX*`IUU2Up8 zT>KqR3R$vKrnSMFA4&@|MESA=sJY>CwZ{K$UTor^A+DL5`^Mb)?bf3x$Awz38h2-% zEd3yh0ge&}$$sZ|_ZUA!bA_Wk3-?xvV6NgQ(kFpE7h8GKwT8#MK%^%gM%RK1$|hs! zC}V(1_*qI|(X~NyR%m!ESI?xwfY_47a7^OBYU*#Sh#57+iKYw>5a5yNx$;+ZEl`6O z;cu31Ql^1?i}EKf_ht&kUnLbEbU=9#Xl-F&4Kng^Ya)J%MEhW-^u|IzaD=Q@LusXB z-SBcA+Ssc;_w%vfvt~JV(W%C<3gfh=cWp+)(|w65LiZ9x6GO^aPftxOU%x!Y{8;0>t|%SFiG?$n|YDH$BWoqSQ^?JTxhlH8EPp4oN6nC*Lk|7XuK8JC22^R zRqn!@-U+{6O}(x{JF6NJR%V7GWn)39BLo|xb{n_r;7NX8A6t$;oC`hkG7U8KF)9+z z20q2gbqc)NQef1$Jf50o>mxy+a)l8F+~ByD?5+NdGbY`ZtUH+JZCB1RJ3PL6QXfkd z(~*R)%Jz>@j(3(E#~BAld%lrnF1#SPmTVFgeKgme&F zc(ji<(r$%2cyC{Bc>cEqT<5@<9m~8L4{{|jy6Bda&c|gYTpXZvryhbS<}9;~KfZU6 zdThV<@kk^{pv*3QU4EN4j?Uy*h~D0+psKN}l+t!miw`!eTTjs~`U$%CS zWWXx}o%|PH3%$KLx9hCeT0sd0LoQxdF&SJ?53W$S?HnJ_UBywQ04RYq?QE+q4QHmw zpFFR#Co58ec8iYWZ*I{w^zivhRYl699PL7_XbnFm+#)V)0xRmxovCWxNJwnf2<4ll z*9#{3Ox)>i#gu4Y-Rt*C)+)=#^RM;Qr#oj8%S?tZI7)hrGA^ztj`rQ-%}tD@i|^8jHG96m&hBq~ zyCVb~11&twB{zHAjmbvr>BM(gb@56&BPK64e(XgTKa@Q-g!s==rVCe4Hw9FJFYu__ z${Jtz@*)7onLw%l1V8H8#UWMN->`nxpJ?leA5Oc=r!soPok{F1X=~5+q+6Eb-gQ}| z2CkMfCys~Ri)!t3dvJ&|d44Nlg<)gseGHN>`Q0#i4Gh>gKGtBDB8+}UKg;5ROy|GO zp+5w`@>@q9V`VSg8G5#7KE=CIQ@x63?icDKp6<4pHZr+&Z{l`b+R|BUy9lBJD%+I_hFT;E~;ZP!U z_kYtW_$+?^nOs6pkyGXH~KfH zp&?T_ba@1Vld+9`T5)GrLKVq|onp1i(%VRRG{b{Hq=yM9+|E&3|LXhrHIAp{S8e~l zh4dumQn0-}lsxh~DF=z^h9OlAs3ep8(KfuefpI=C)*O=?#U17qN3noQgf_i zYbOlkh~7@$Q(&}LDH(T$Pz?5`T$UX_2?(Ns{8hs+3*ErRI=rAC{{jliF*jnpq(381 z9{|G3m@t)yku>*!drk!Ngp3Upy#;wSyHxOwrjvhy>d0^$l+rNrvs zt&~WeR!NigajIVltGXtzAoHKMc054$&e73yJ3cDPvAF=~p55h~fPVP>+Z%&e^`e#& z<=A)Pi}DqD6<=@sja>Jo7ah(ub|i0RHC+K4ul2pA;~qGeNbAsk+#@#5mY-V4Lz|tg zG1c`!rNGkb!ZO5np_6+ei|hQPf*;HPL}gnA1@axDet&9M@d(Bj9QNv^M1~95+Bn`g zloQtewY;n=RnUPBZy_gX?p42nhTMUS;m$I7m78UIo2tYOWq4lr+-6$N8K-q8Yd zQQIW1SjFju?mrUc)utsQ%yjA{)#}~~QtUPiib^B_a9TcJ-|w26=a9c`b>|Y#m(@}w zz9aa6z<56Vk#mU%g{9g7#lfQCM_p`hT?1&OmfBoMnxXBIAYKhk^}&TcT7KX2L_H6> zUZ5ANzt1}PG5)q(nIOR;in-JM-GkRlhh_RBx5Z>a&oLrY;b9K(2`p_&&2f z6QnArKyvB4ZQRr0@&_{#au5-%1UU?4q_VWA0K>g5wDPQg&I2h{j3U8vSdWOnsa&2^)w>?XJ`B-hE#*7LI*{5f7pS39-YcvXGlQhaSa9cNtB7u@wvQ zKU-sr5R2p2KD`^pkKvR2Cxi!r6!^_r%)!DTG9@MDNn=0g#q>(MkR{(n2te6er-{q+ zT$m2NuGlfVMO1LI<$_~K_DUMyo?v3CV@o4N`cIg5rU3asJ)PzFJg2}jLHByw0~D0J zPWhtc3+%lpJl2Dq$ObIyiO>j^gSq?<5g)-@JRNTf7n;ZUmk#$c^fcLp%CW>i=|?EpN*VNv=EXoD3&fe5CIHf)FgN;$_w`XbX5Se4jo|Rfj32+QglHd<-zMyQ-2`_4j z`PzqIJ5ckWUo^!negnvHw6zT$nCSTX!@O#5YbB-ssPilGEo3FE=F#rjYg`J*#8g$Q z)mN_#_+NB=WmH_vwrvs;2<~pd-Q9yb1b26LZ6v|n-QA&am*DR1p>cN_=aKWyJ?Fb` zjQ6j9^r&67Yp*ruT(h8ASy+B3D*K6jj&VFh3I-M#ku|ar%c*Q>L3gPpHF+*4J~1at zV@m&fdR}4R^f#(DJAkgX>ftbz6FZN%Qz=HesRJ2c%xSOnc>zKeJI)Pc zB+?i+Jpr$nJ{Z}#1XHS)8`9LbHTxq(TfDagW_c4n=<1fU-S7Ah5zeP4_Us~q#j_=~ zy=}Z7(I4cYM&c%FEN5*e^jd^Wwc)1wUFV?fyT@kYP_-6+fD|DR0pXkV&ozFvcoo!V zl{+(k{=I~8S|2;G*Y89Q_ti23^Q+qN zoV3KH;-cyf+OC~XdkE zN}6|@UQDhf{o;=9vzHo9P97YFZ-3v?zc1o5_Ul28oahsdb7ELGI}VYIoupC?-5tJA z`fP)SO*`KSr_;{2GXwYuyOC+aU;R*m?iBpietfv5`@NzERfTgGOQ zflKU4^u({g#WJ1-A@9;{GigOfG)JUaiKYl z&d0|Oe8Gs{NI;CLx2>~Fn}K_$twu>+VF!lNL_3jYso_?dni>iT_Hmp~1NA`6pL*ZD zSKi&<@Wacs!x%^(hTc8c-6)oHqvehq{^#`3`%Q?l1KB|!ZANGvrZ~KqZeUPb%FfaB z15gIfO_!)i=UEvA)A8#jMH-LK5$2lP+ng|EvYmtfck8%t`^}v2=T@!US=g?gY~sB{ zJr`%qLaYjT<3eNd-BW<)es`gMF^2L)?NUMr1ljuLo z@$SF=2=%1}g9a>iQx-oM78zVRrCxqFy$ro5Il-VJT1#BfV2UwUu7L^###!UBgcAn1 z3~UZ(2+@`(@kHdU8DBX{GyVz4l;sL6L{EWs0DkomH9hXvQ*ka|oGUe4S)uuSoq%hs z7G^|tNLql73z#kcQB}@SY%-Y}fx{MO3-3)uOWh5WK@A6i zTV=L<%ZjE3);2_1jFd{0dm3kmgr7eBPY~S@e@CD*aA3}<4rS{t2l>Cd>m%Cu^B|-P z3>=OVPUD%-W&gQG%kEb*d4k=ZNbMt5X!1QvdK(^gF_O>qdYPs>S(?Kml~BvRv~g*t z+_Q63!GW7z;$B|dyQX)nHk;{;#jFcnb)hJj@=~*oC9AFIyO;Y^_O=qUj1+Oe%;Kp+ z{_*2^vL))+-Ay|(kRf^C?(*k`Gx7-zwQ-3tx_Xi9wg}s*#r1y-Do*V*}09NVfo8ARK ze);>xIVR^H2mV zCfVuG>%i85u^g2z)v0m!pk^_>?!a=6uP{}S4fIjb0xSIo$=SarwcTc`v}&Nlfue3& z@{N$N$U)uTa0v34a#I>8w=_!}W2=*{%|J^ z@O`_Jwv>Qf%LpLvUp+ z)A7f+J^oV!mz4B3PVmhdk)lh^-{!(cmXtC@*cF1J);v_RM3}EvXNtbFcR+Fxr+i;i z)#KQ<%v7hvXGy`===^S}e3Q4Nc@a~XEo*}uhhl^J3IpjtL*rMDoC=XNR6u~Y0z$;e zYDlesz5xA~mYpt%P)Zh8JihTpVG1fL2F!=Gxepj*mWkM@%;D4WxsS@N^IxR$Ia#NY z-xcZTzVSUEl+I1J2#8{aud*t?Hk2{3%Hb8PLL#$K_eNNW!`%9TGo?yh zri>(y&O}qIvpd^oBFHQK1L$y&e2un5tW~G7 z9{q&4V-Els)iCDmP^k%W4!TenD-JvxAHzdm9jaj}E>3Q)XX~Qzmgcyvx7D5@BK#EY z8v<&r4QaY#?KoIC&gB=6+0?Z;5$a03n#TK3EM;S-tr>V`X69<=%K=pl#3Ke$0lrWa zCn)RjQAx>(?(X4Nv)L_iESMJiE$US4L$n0V?K49w?hA1VQ}^KD5|#s>_ER4xxK~ul zFCaGnLY-*Hyta>uiu&b5j@hsbcASgkllpUs*Ve`Cc6&F)_2XV{YTf6o=;>xYUPsCGFzg%$-X!Oiose zLIH&vk2ow4sHj)5)R^r}F&S=Fg66n^9-W_~ZL3f!@xCfBy#j_K1t#vRZV!1LysJ!A zQ?%`hnQbZXaia@{>fe;iVU;+Yn8enjcmY9Pw9PmDBygEEf-X;W?JG194`zV9Zg5oUK(zM@7X}~O&nDL*p&8c|4%~2NjR`v<8berlc%0F-dEDh{ z3p#nk=3qpyE(iV#NrJ=cJ=ciH$IG`!r&xt|1N>hjBT@}WHj5=6n;#?v{juY_Mx-B`2h*X>v?N*QGNN#95Z>9x_jzB+sIH7=++TP>$h zh-UsR_8^bO>g!lv-QEM0_&B`WwhHIp#fg&@RA2rH)zY&#S3GMaxN3{toE1JhSwvcI zIj_dO{SwdP;b?Gf8+Sdk)aFf-Y^yv|BKR%2aeTkdW#6G{Tg)`Y5=-wha<%Jc;b7^AXmjuDad=I1M)Lki4tOhxgw|{1PFh4OA#R6;y&EjY+=IY7c1>9u&zXxg6-JqLV3Hq|ygq(l< zY8BMAY!2ObL(MgGyFefsJRgVQd=NKRSI1m6cK&^sl#@`8n;~hO)CC8Q+m<39HL8M5u?zQ8hqbwnr;<_XB1! zJFiS%<#m*Swr_DX^Jm-hb-svWQ|;rr25y5RMXGkf_IeJFJjWc)KJKUe0 zBx~ukHAFx(B=ulAO#dm3qox|H20DVceJIUzW&{O^ZXiLD#% zQ?&S6(0^X(G^A6K0* z%p`qifkEA4#-lZ}-HAl^%0O8fb}*z94Xmy8>(9kbE~2||tm#(xX?C{D=`6#kKL#Su zi=%pcqt~PPbM|udDPueUmLc9QzmGak$Tk{?;5`4ex8Lc1kV4`kzsO~Eeun;Nt#Yd4 z;Ot`Z)-&0h5icm_O7+VIpty?CnZ=tjznCK${$o$RHQEN68_ujV2W(`wjWiXra+Z3+ zi{8CBDQ76}$5b&|z5$wVSfmPF76TISab=v!jN?pLr-D(WqYJn8wn8K05W3k)P8G)9 zMEc(^+$=RY+nz+JEWazgoon+_Tgn&~K2E{=Y)f=wt()#Ay*ZN)V2Ik~Mm;$eu{346 z#SNIvleJlp!5(cQb{MI$D|q9331tCB0$zQB_&KGaKdiQ2S8yhX%oYi@KV2ZXl5WBq zF}>oE6`F_)P?QGd7MHVhtg;PmY^c&%Cr+P_DCdos4PI!nnX5JxQP=yzhCN6HQvRG2 zSz~OGAdU0I+jXh*G(pX;zAlMQp7BNLNX?C&7^v)Y-$Y$tc`OYqOEwG4X*Jyv@2LL3 zkGCFA5=ds9@=B?f&Eaz>wF-tt)!UTz=+?;ccE~!qn~(1}yqMumV=eQyk^77Ym+@UR za_@7BIMY?d;=?Rw`)$UC5~5sd zNnJfxTF!7QPS}{VSl_-<5ObO_gztup!M9cC_DZJs5s&7ss7M$Md~-UOI^xLQ$(d9o zKQ>Tq3PG&KKS?rL1G zg0@X!y9c}nnk6H4(9lq_({dM}1^IQI-{pyOTS;XXRb@QRpv62ve4GWiJxuN)ySzE! zFsgUJj%y!CCACK{+U}$n^Hz?GJw6{zq3adtTFK3F+39Kh`bzmRauu|9FwR%WGgV;w zE-YFaxvndktuhfWk|pfPOBTpOvx-%a?JhB|u5NrkG6ECuflizU9=e3ffoI!A)3Y33 z+iE`-z0)R`rm}2-EFqJ6X~L-kX}~Hk^-Vam;4X z(KH2We+IG~v9xD#Y~;#%+?|g9s0qeScNudxg&R);gIWyuX)~JQiU~bJkqNDhZ}@Bu zSZ_==uoe(11K}6Q)19QXpyv61kl>IvK=Sr0^?E9COyS}>S<#NceP%WPRi4k_tyN!O zaSr8?XMs?TkSMeU>B_Y}I>czi2?MPrZ?LZlo8PZbTvse_GEx_xT1WNCN!scN!6$7P z3`RaY6g;N)A8vO28L2h#BhD>xox+Hzj+LTf(^%}zdicTus1Mk(lCvD0=AJisOps)? z*$DQzrCxI5*XZc+#oo0_WA4bk+7&;9N4&dMfSo>4_O^tBzv&+7dBzmrQx#9eredR6 zt*3~Uc(o9z8N~$3Y|mRvUSF6Yd$rh7`Sf^imCs&aKYr@vZqz@Ko}IFN%b+{nuhr#= zSrkLeksZvcw@_DVIBjro?wJ^&WSH|D?8b3&qQMjC)#)!Lu-OsOVSs&|(qj%qY`c3GCqn4Q>1(dm^wF4usx#3tP} z*E>bAj=?^Gr=4mS2p7e@F~wXd>O`QepYe4xg~_JZE@$8N_!qM8z;auc1KpJIBB@-> z%qOXChck^N@r0JWueXDobs*uYdAwewjebl*_CfzKtwy3QG5_yzt zjR5)U1vs2HVmnzp^RQqM!3WJWJ>`l8D1L%>(>>330~79%5Ased@N5t-b8=~$ejsUR z3ce>Gd&~2it={cka(1(3M?$BS62|po0`hK6EH4}%g7!c0T*BF6byPi z)Uh~s0r^Zd9d0OCV^UMOQlW?4gBBQD4yHmDOe9?)hdr<>+$XUnA_C109rU!=GSX)? zlPp9h7)1KMf2F`*8Og4`ZLl|4n*}=2SH-M_!!Cml<7xF=!u&v_8@>-*St+ccWc#!h zn{)BF7M_-nYJ|%9YFd3N=Q+&w!lEsRy_GeeIP9bg!kJA>RA|Kn-mq4atMs?a=-_;e z>xbtheq7rs8|yJGuLD>>!}|yO$wTGRcj-mL6)&otsIx<*i~f&tP062j3zKeA88Z)A zba&qsDqG`=gx_QD2mvzi zrjlq1BAoq_1_=R@(Xz&HG`$x3HRJ8kBkoS08jF;IbT|Ojy#0of2Rh3{f zM7m@$^)xA{>#i92agL#OSFz=1UZAff^}b0Q$!I#`%cS-D=J zN@qI-lT|koD$#Q@B=`jJzqssYo|s{IK9wZSxHhQWE} zHD%ic^Qo9eS*WY6HF@=m!%s<-x?VcOtB5DL!V9vwH;HjhFy>3mNYg)~f0WK5G6)Xk|h<9;=l!Tr#Ct9e}wBYY>CDk*G?mFkc1X^0Bj zTyL|J>Ybj@r~S7h2?)%y9i$nY69@9i*SEz^>il&y=N)z0F3DImbu~Tn-GY^finWds z!$S&-rKM4ZK6!BW?F8ARGaD&YT|sfr7)coSo~`NHXJT;gAKBFqflj|&ia5^aU1vFC zGteJ>@%b@799SCK!0&x+6!`#E#>>M}uTJtnaF=`P7t{f!+g)rKk4I?TdoLCo8ZGO} z$XP*+<)xBvY6IKAmMS=~E$|{{nTWiD)8C?QFIHV!tT2#*a6G+d5S2jxNSej{^-!|C z*_;Q*3SeDkEg=H&9*t^d&hO-wGSu$pOSWH}P>`ws%uYu0u|3Yc+u4s*$oVfQeR_2b z^slSNe2TD92{XpV)J!jygpKY`^gjWsG@}h>QDxj;*>tm<5#O{D2Vu_z1{RXVnYSa= zxUgUm7V;E`Vcf0CwHPW}64^{W6|6qrnTaG5lk>79K1idly36Yl?gjE+5DD3h2blDv z0i#dEoA$mCxEqkO=z64bELwP+w!9uRa3gmf5_of8tfV|f_+ET5ZGXkVWx)7jZuDzl zCary&#$*4qsRg{H0q5mHaF$?54pN+#wl*;FHaXLryT3 zTPciqEb)`-^rjhb<4;cm*5$KLEp-Px*_T9^sg;qiJ$RofBeM5zE)%UyfV--4OU`lt zn@p)wrYcybczYGsfsZlql3`4LKzi2W;Kg96f#y%QB*Vo(ga)2GP(;miwArmF z_H~-FsN(@AogQP`+KNb|9Gjhez;C%{1=1<9X3d)U4qt55#`Izq$mldM8iCE85iY<; z+~mY$1jYnjuZ&^KWV1)U$z~43l5W=!MDq@J7V1s8jGgLX2iU#tDqhor(;6BHJ#l$XC6BO z1o5&7NA4eNk<8VojRe3G_bUTU$?{&0xl%OhOfR>BVE8kQ>RFPp9GqNMExJDz^v5V|e*e0QUenmn}A z!75>8h`bRZ5^N~sybsdXNek}oh6hN)ugrK|(NsFP)&9D|%LB30xZV&=EvCk0peZ^^ zF`AFf3q~QNDb`*!xHogfWhVwkwm~JCcygBpLhgKm^8?6cxAT2zlVlOeYe{d$|*b8n@-^-rQimM`RGal0Vu6Q5H6=~nc0sHdNiQP5?b^uSnW zdWmE@KY2_1`JEb0yWA|D8ND_$(zh0R*Q^!*0JAYe(y^L-0-Gx*~ok*cn7q9#ElFA(&G2mFmOBQq9-3Rbn`xRtWwD@ z3l>kObGDwN+P;0g+n3~dW+GY8to1!JBF7v)%7j|-xlf=Jp_!kIXjD~g=Hw}(0q$aA zlzNMGiAK-}?4lNC7ehrO9s}ic-p`pce$$&Xk?p`$EF8zC3aQH7LtT0ib#Q;@C$TOt zb}!E6xGCbBPXgJMn)PyTrxK>hEKy-pbzM#O@O0M94D(fZWVX1E^m=Xz%%KQLrE82p zG~zjsp5D3X>L_DgD24&a&+DDO_oaB_7Nn1T{z5rRc*f}()Il)`{ZZFXH8tydiM5-qh~<~UGsdtB zy;7b4B(>+|CG}}W)&Ky&^&XKnli|yQfFIgU+#5ZlOJcph8GUR_Qtq8k350`B6)RgV zT9Xv8wa%RaXAv>q+i06Y`d<$KD|j}OxDkp@;X*-VjuV6x3Q!MtLstzTkb=Vi9kg>6*wr6=7fo1&7KeqZWhx#Cy@GFx{ z$p1B|RrnBJEon_nM%$;8@a4>?=shKP{|x^Rx9$TY8Z%l&^|vd3+1DKe;x8@#{w?A- z7y}C-`EL@Q)D4Yl=zpXHaXcaa)J6PPWbywr5d1@xAkk0z|F$hc+~P0sz7qdtdDn;% z=F1De{a0=A?Z3Sub%U`G{_j5p3x>n~(A9MUht0=@F4%$#o%`a>^~0^+{uyq z&mbpqW7&89MK%BBR5E+N+5B^4_5V3dTRj^1r5Am_C!?KLbG2li$y&+@Nk262X2I8LF>Wp-;Cjn}(b37$r$RC^^V_36!XoW}OSgfCU^HzV`F+T( z_UikJRy|cknZSjVR!g6f=cnyB!Wy~A-nUMsqV37tMJkW#49Cl-eMO1C`{a#qN&@%F zmoRa96}qOTdt?R1$_m%orow{z-XV(oB{;B!Ke{}M+-$#+9`(k-l+EzeIH$GAk zx^L`ofdia)kz=ea&sg4jOh+1&9#fFGmvwNbJy9i!vkL#(X|H&YEsFbHh>@u+kNTe; zyF?sai5A(te?P!yPq$p_=gAz2WD`#Q(rH_+Gvg?xr@+Q9S4ctYo;U?aQZwG|CYttF zn;p{=qeNUW-mN*fp0D?w=|D*`1(wpt?O&W_YDbKs10adz@l98|!<83*2i4+5ovn@> z;vOFPy!+``ue%00niLa3GPl;2VaE;DV4m1HFqRkPk7~YCFv>d z&W-n{CFc2fKxoS#p}pOflNFDkl6tMUsUInF%8jl4)A(l1NU>$D`yx8}=UIFw%N@}} ztZa}?`Qy6>cQ)D~BNPmWpJK5^MY5L%J9{zb2qr-F$0r*t(S4sfByyY)PB&zg<**&h zz;#aN1~XyhkKM9ZQlTNEY8*g<<;h(usy}~n&Q>*4ki0D!co4I4)lUl%K)1WF_l^^s z*2;v18NBV`9e}`WeDPt*who#$30{U>jRFib$E_&@wu~c3hQ~3cyOb=oRw}0PF}fNw z-*I?uKOX*}MZ!rl=eFIK&}iqNukA-% zf7H5J$S|eqi;BbPy)8mEh65_N#%vLx%7lstvqr1$da0B%pW=%Rd$23jVP`N21uzva zQY4FIV5|Kwv$~O0?JcYgln@8J3j-hb!Os_#tu+L2q&y8IS&EyA7`-HuT1)(`S@2ow| zZ8O+TvZ7^X0&TUv1mm{L7%aHkcQSoLwGiLKK9Lzr$Swr;2Ca`0s5S}Xaxi^$sIZNG z-bp!n^WiY*Y7h*af71-u;FW*id%pFUmq!mabx~RGIAUc~PkFA-yovO*9()3Cx>iZM z+X=tBgZ{8L{pC3>c#hA4rh6~Lw{V-d4(U%n&Dbh_du#!xl!aev%i;bCU>gGxASi+{ zGbok8k>>Ei8E9{(a1Vy(KH?^;JwF7-bZ*04@Y%AJDLmeuAc>432NSd1XnMDtW8b1W zfoE=>7Qq*ZW(Nl4c<0uX$bjkNqRkt-t%Hi!(}yD>|JF9!ysv!k)v*br@S#hucV*;5<&oQD#jWMnSS#K3 zLsj%(f;xl{67Jq|Biwb~qGtjRt76ZIcP~b)j6i_Id6P)kze0nn{nX2882=NZx8%IV z&01v}B!axxdCdLVKdFOU>Bik4r~a?V{T;86d(ngwWSK{z{e|E*-UBEHJ+HhwU52+u zYF3|6Nm=59>jMt+9*Po(ueAtcMU;*L(e01;I6Q7AfqG_uLixo{6dXhXbQ%4sY|lK5 zE&e=s{1TQ1pI2vK=3=|s?)sb##}sPNhvHxSuo~_m0gFBZgLP)pW3v%sY}t-FcrLE4 z$Zwj=;3<`x;{6aC^_yLv0s0mp4*6<}scdazAo^szQZ!Y)j{ytt77f>wKzj-&WQ{*& z5K=&tNHzr72VNuiqEcpmS)6>+^vuxIAToq%fnWC|dZET%MysMC(7!U=Q(o0oXa*Lq zg08x{Rsm4k#?PAWEX?2G$J$4)Bkn>1dF~po@uZ0A@)S-3Nj-zHm6q!z`;+PXyr9P( zORJ{CXP13`To-y{89w;LyWNc&@|qlc)!#HYB+1n_eQzepRhdgWN3+!!m z+&^Ah9P#}tT)Q%3LbcR>hdrrq#w*30Zl(Ml7d1)-tRxLr8;CNGVY_Kb1>g8LKz6*) zV$xCRytjM8IXnYA=k0w(#8_{6OY;2DhRzCI^1k!YfcUC8G=q(hNTFgi?$4q@jB3U~ zsm-0OPY|?N;Gu7qV9rh3717e(?|bs6gMlV>8f_Gq>AKNVV~T@gy0QnZZ^oUv4GLe~ zL~S*&`|}^81z++VSi=-qoJ{1Sby+Flh!FA)&U9QO%Z~7 zguN~%(C)(Ovp7u>JfAU{)=T{34>eNPefpisi;%T}6z5*GArQ%NDjd@D(T6@FUJ1Nq z27DF~kfS%17~hDtAU-|vK=7lf}Z2qB{}<)UD!FL0F(nrm(-f_3XsA*AD0SI8a}9%F?MwV z;1x`SJ}lS;1g7dXRLV&!c?!Z(EmDU`yp!Q89p}BW_Ze3gPU^SbDT87z`)hYCUJk^e z2L4dr?+o@%T0h_yJMP_Ekh7^4CVN&1s`LqY(fG=M)yRG)K&y_x!Vam9Mfv_zWitkn zYP6W(65@Ek-Zt1VQ3Py`;NmWm*C&_zqOK((ET>~B3s%jq*ZQf65bQEhVq650i2=-Z zucYASQm{$LClt%wWhe4MtCz2?ptsx^CW34`8wB6i&|sO7 zcuXZ=(pFm=_wJ_>TIr?g<16-zo}0PacLY&dk1de+qs_5M_DSOKY`;a&Wqx~JVcQy| z`>63={2{+6xVHQi5Uz5)K_nmY29G&eXZM<4mVTrZkozp#lA0_+NepK-`2DCw=E1T=fIH51(OTV-!gay~ntbL^n+q=WC*J5p z+(c)}{c@Awem$#|TXPv%@#&wa4nJ0^``_bya~hhjw#Fx+z*##;3i<4lE*Iy1@DWh?JsmIXS`%IGFh}b!8y5ieP+Pv;G;z zfbnp97w%ly|LyiG(%=hc1?<+#DQ>9^_Z#`$Ry%ileCx91f$~vlK5Tl;ahuwO>}p8( z*R~07JB6-IkTgXsczaeHmnyj~p$iAnUc-rb{!n;VYOu7;ybUXP(9=C1Uo~Ntw z*lGzb2_Sn#?wQ(H%v$a}%Bz9STO}a`sn-!|ZQv9?wgf7~_&WPmyBBq5%q(BtmDyFZ zmk(F5DP2ZrMEbky!i#x}^KYAS+!GQWrtryA4We;Ryr%3UEiT$gKxq?n_k>YR^~VN zj`NkZ6=_ zq#ZobBno`Of79f+uCGKxY$G`nYC+(_k`oHkvY2NwN}+-N{x5(h>g`ay?`mR-hA4?g z_FP29@TT{{fh9s0HZ^ zFA+0c)yN!;>!6{|#RW2)ir38{sc`*Zk}65MtBj&u49UJiY?v2ca|zcoDckp5Pr_O| zi28G82gHSQSrrz10jY?Rror!(?%)rE;`I-QeP-yP!Z_Lx!VXWlzvq%sd`Uh!VG4X| z$Cr(YLGjHbW?`^=N=L=d{3ZSaYhq8dufHg)`7>zSP}tOvmP=F1;hbNf6@0RTyOWq| zV7u#=4Mj@27s@E)P%|Beg&sVy5ssv1R*RBHImLs710tEB&>T{|tQO(7zXOI2+90CJ zwF~@Ye_I`crHNuJRQf<>dPfY`|7kxOG$ z-vGH0&5UAbm(WZkZbEu`E>ly1n0*ZO!)7N#$l)e>4INJ~zinC5>X1ycVD82=mRU`v z-O4-Piju7PQ|-ss3HEsz$Iqq2l~V7Qvv>d$Qj&gk=pmimB@u@gp(JWX6uYzUc?=gM zYAEoCFaiDQ-5oNeXr4du4ok@ltgxu}tw!`6m{(sDPc5pnLp}8MnL*c7b@y|8K!l>X z)eeM1ZX)&%(W*u)Y@s4GRzt#~o+;!_UJ9_*{^U2$84@9}7U}N1heKPT4UN$3GCRPj z9?t2W0@C-ogGnVO_#zZRQ%Oyco#q}U_G@O8z)dH>WLH8W1Xxe_7r-0V8yMrFDg5?E zaj)a|%#cTW#p8FhA#OT4d>}u;a@#HS8kuo#|JA0*Yto7*K4rR2bM%m*;N}X(t4CaE z&4OEVR$uD>qH}Hp@5O@ejL8fZg?mb-n_3$qRHLDLDQ@_9tgZgUw0RQB zcKY%{Nh6}@92ITmJ#oUJS`tqAGMivVV5%OT#LH{LG(Z;dYDul}+!KyB&V2eBn4x(` zwn|@wHG7GexA^Xw5}}qmHmQeyig@>iTX6MyeO?NSu`b6&DBvZ4&lCM;Y4f7phvsp_ zafJG{%30p`q2l`D5=l$He$wu+Nw9uRe*gxi*$+ zl5cz`^u^x3VpM5TU^1M+Td3&p{+wuUN=~lKYV2)XeaFdoQ?xc7Sm*mD*l5RPz$HuBiTe5rz@&iZ7PStDb~w8imBSDH-ORs#PLw#lx!&14eV!j@VMM|7CtbpkgDw?z?GhrcbQ@*16ZzSY5MbG zG=fte)9iwwlciZ;`_@#l)0c&6x!uT(i79Uwf6j?;>g!*A9G#-=3j;COwJI^PIZID| zJ)+>6rL3y=!b7?9+^uA--5SUmKWevobw{T?M)|%LpB^wvjSK{%H3nr6x@0s~*d}!4 zDO@)R5b)P0w_v+CO#cEMT1@XXVsHPh5i==u9^Uk;B`u4LgjZEOo z3BEGieS~qfee!$t=Fw-ME-z13w7+&mrz;Vv5-r$1D4`(Z$X?3Fq^w~pW+ll~+Mhs5 z*OrOYx5Lw3cc?D=CO{|a5{-IB)T5Ic-A;P@sSP2Mgsm8h27rlYLl=RJq--o&yFVpa zwHYFM{KvmIpNuKF%INg;S0NIdLULZUN|Q8~!=Dch4#;>sKYkyWi5uX)(IG~>eVP z7LL&EL53WstKMEgjh~S8p~qRBvEue60*}|DSd5PR{IZsY7N-$UHsN@QPM|*o^ddV- zbxDLlc`|V*aa=BYtk4!F0iQh#BzS&n*_{{p?Av?2K-7%!4&FhSl~yDE9vzO`DPN?T z#-H*G3gCA)0j9>rp-PxE~aypq4K$cw1NVxrc_htHI$tfX1 zisBO=eh7DU_|-ti!Dbozf~uz+!OCcVxdNIc%`g?ypIz&W*E&kRus%iHwK-8Q+d=xJ zRJ)BwKL8Wy&(QJbSOIki0&p2$4gpNUynoF3T{vuCfnz=wP zm>Hv%v;vCXi=i|Wu1+8!W?h4BtPa%>Ga?X%14N}2QkLtUHfMV(3&#~S%H*_AyH#v5 ziDX0==y@L39Wofj*HM6iL=n0SJ4C|(h680bgx5Q0sGe8IpO>@N8;VIoQ|J@#ym~^R zXtm8Il@wdnee-G@agXGrwDL7#)yL*l+|3SHaW_X2_BawA+bQsLZgW``jEUFn5l_N> z5GwhVPr5ZvLw&kw4Mh5L+#{x}9&>Y;i$!KH)!?>y=o ziZ_4qB!!YfQgCW`n*;>JC8(qR!WlKPgwha&gbQ#7Nl(O9&A~vr=ZL3Pr3V^maQ5qY zza7K5e;vCPMKLs_y`&Wi#_bm2%C6db6B?xswwlqcPeW&8PC{3aHr0bGgWoHI7}l;` zCvp&F!e&24vFghgBeSg0A`>+%ekV9K>k2CQt`T~oDI=$_k|Ei_wSFigCY9m-Q4V`> zSu2OVJ@~hrl8}!WwYYrNH#RMK`=7yw2Xs}oS|SxTNW;O1jL)$KO9zgj&2gc{$t*aP z4y)4ExK~x-%zG%w6WQO^^N_a(8n*sCW4G7wCo#I=o;*KSHv_gCErS=$XVXhEu^W#Vt6lW5^rc{pV_<1=2{8{@(A67I?st!%u%kAuM&SHj z!(w)!w>#8AmMpQ!B4EyZI$Cx=K4kL>qqo=^iGVtVQ6|)vx-Oew*sTU~h_AQ0bGs!a zT~t}-({3X|Omiv)|B8%-5AQaG%+qwTzi_s|08P1^qs6NBneQoJ%P|mPOGlj~!1sBt z3F~srGhZCtNp&1&gg7@`ik`ku`bo0vI1e$)>;d$p{pym4_QYrD=gj5h5SIMDVGb!&&O_si3pk+2BlVVl`?U+pNG zj*is$qtUy*doT%{1xl=>Dmzs42u!LkaF1g+GdS61kzj~2>j_aX4q@CAn2YR=W*{z9 zmKS{n-(bI@OfO4%T`h2+?P%{Gs$qVmq5?f$Dd9;0UA=Xr@f-wIMKIk@#%RP?$W!7UK(<)v;+XZBd&Kvq(0{21VFvCCo4kRMaK1FYv zjU@0o^iGA}nKT}ws0hclRur}ulRFkk4p$00f2dofvf4ovE^}bL-O~`0&r5FQs-C9S z+%WcQI?>xchAi^{72HjrP|fI-yem9xzrAN%uO5Pjd$o`9rQTgFa?U`;)6r!C=IUx`Crd2@h%^}c!5`p z+BXrBp#&Vz+4}Y33&YGqg#c#`v2h^Ssd! z-)b0h=oZmLP)kv~*Mn9TKA4-N&2@V|aj+CEa;a1bhy1vu)|)5T$cXV>A56g&)t9hl zS!8R{&eIMH7HIQ(o^jqFV2bLnG*Il(>LuKf@gYa$cHZm7SCinWONvDt$2>owN(*)~ zJ!T{7RGTzDSse`FZubKVcqX&o0@j=f*{r(0QUo*MpKY1zLLZw(8a%f{Nd4hh=6E9V zjCcz;d6p1!I~^yZD>(J^cd)Y|-8?j%alwHdAz3YP2PT zEtcP#zg3&B4y&r#i{0;JV*ey#?S0L*Hat&h&Wx!7EaaZ6YW>9wd<`)ovhgrK`~wNGBk`6 z@p*)j`ACK`{Kix8tqYg2u5Wm`TU{YtW9z^=dO%+mJS~4UCj0^ocFdn$Dt7movp1E& zm+D&}F+a(ysi`i0@|WLqj$ZQ)a@u4d*FP!dar-!MjzFr+`ad4of!JQ}+m) znww8nE6V5*wKwHr3%9-&&bTK)f%oB+6a|6s+u0+SbR`Ppizv5Kx9@o|4)V{~tWQBA zg3D@i3qcB(bzo&MK1_)IJ&a%388^cRtKr+?x%Lii^^+A%ruWYwZhUVtKrK{9+3=*a zlfxM;c$lTy=!(~lw+s9QalWQz5uk+;*hGEhp(Soo;@G_0=Aib$rPJ)I!nozWjdmeB^e=+alKcP;E`n(glP8Y1i{(1%V_%X)EsN&r}#j0A83r(3(z%jzZLJE8%Rfk zAZlo*7QVmV*b>TY z4pJ`V`(|e*;|}NLjTQ?QhXV}XiDC%tm{GUYvAvU%5Cx8EY@UK!O{--16wwwP)b*Nw z{=M_IRmQy+8xv+1#i|wWWMt;=!Du)AX;80u1zka4cJ!i!I`bQuSY&E{kBi>5 z_Wc)r9uiI3%T0%ZfnMIFi~aDNv&bW-n;o)F0UW7K0QVH#EhSScUR@gd|@^!u&vt!v6-U@0Tdf7cDa_m-BN2rHIhS;IDb9%{Yvy`aND}J#CQOV_Vz`UQt@QrB_M@JHwl+a|piV`p5_-Y1f78|^z z%&kT4*g~6qzEI5MHVg&l{l@@@dnM$lGzwQ|HE7mhNaPHAO>jKuuusVh@h?hUh0Nl_bTdx_)d)+0kTjVxb)vUh!&AIKjOy3~3G)t_i zOWV~#J#>Vx2{!?UTuhvuXdSzeyHb1cs#FpS;Gy^!hrAo=n)d_nM~Dbz2ZQdu5#rw6vTDsVR^bX&)u0~ zwQJMB%rP{v7OZo(HQ+XHt&1-ZvU1fql*zEUe;)y6sm`NnYdSxUF@Hf_DGEA0+7~V; z_Z~ZR*`7lc>$3Nr?NnSqE;&_yme0axxi(w%8#Jc|FZtg*A6 zvZrOWA8i+-8BRFk9B2mKtc1_cSkf%?X1;i6&U|5cB<5*TmrvCp?#M7G=C{M+B76My zvc)V#MKug)HlWeuuo+;1=`uU4^(-cV-dza`Nru$SRlAF;YuAhvTaVNb#R8ZvHd=3m z4_1XWGu`d8oL%PGv9KtBFKuvgRfyH#T2aa_x*w;0ky}@m06C=h&o6V0 z6hz<~xUuWrYcE=B1+IT4oXO2ueAkk-Tlp^5LI6TMPTtA4!g$5!s3r4#1WN;qjMaQD zxOjs5?qS3T7Md~J4aJBU3YwC+x#+i}p3SAv$IkC>Ddc%>&@C1bh5M7t(G?b3@MgmF zFS|38SF!0iW7PBB735h}FoMJkC!$}|(+12eir}qi_8!J@H*Q$x`q4#i72lcu+Gj#v@35Gt(8^ID=Mf`6DwNq7I%D}A~B#7 zX!--SBVjv3(mAZBm7g@IqNq zxU)}F6;%VQ?Ez@#&nn zX`~`1nZm4gGz$*)e3u~?pytoQv`iX);-Ig+sU$#XjmC1p)y;xdE=*#o7pX67$?kz#0I^-1B2Ol z>w{Qo$Ss(lb!+JLHv=x$m$FrT8|NL>WOkoV+H~lnMT*)}GoU_)V7A7m(`q>e{ka8= zh2y0k_p6p`NvLS(I~v_2BNP}Uq?~7}zH;hE=#7`Nae-sWG+msHPIwyF9N@6m2g6Mj z^A^jPV>orj8mcvf9~LOt;}KOB`#Gz_U|Vg^nn_B^+O{3Zy{WnjhQT)SYS3~WJxps| ztdMqqNjKf#ULSiJDs&5VS&g#W3dZaj!(5@PnchYnMUk>-#|=_dYdMOm0dV@)rNO1e zgot@35wjCJIfw??`DSjZfXys&8SDhlOWLACZls!WGi4&@97j3N(XmlwqUAy-7I^P& zN$V5!`lEbAH^E&l^vIA{#}KYS2p%T0*P~G^?`Crv{tHbMx9xAf4}CW?SU;#nRe95E ziKp383Wk!VUWmONVh2M){T&ZI8qW6H2X4G^PU~Q0g49$B8b1qzy;GOZ4LPy zGoG?qNX+K}DAitEFVIijto#KF^*k()4zhJ_#xwxsENQ#R#Ok*PRJ`f%Lyzkf?{-o| z!aU$*y|$mnf~Hj**rF;Fx&2?@>3n0EQwC3c?;h#W9@pC&31-zcuGWU41GVhr89JB_ z;}wjzObtjCMfO>Y;Gqh2s;p%Jrweb?9rpNHz(v_bXw{r4rL}epliJPi#7K)X*e^*JxUS7ZSDVZz5*NN_lQeY4bi1v5X*8W20%c#HHSP4@MHd^bV zkmSuj;y)fLU9ED+;KVm$o7bYm1Ci8FBgdwNZp*luq2u@SBV(}T9Gw-_Yw&zx!alGu z7A|awY`iOsyhERQ4#N?04*hM_zi<`Bf`hmAf|s^yVGd|FKQj>D=Q0^Y3pAfD6$C~C zjOaxG!yyr_wIEzJMf3y}f?2Y7IM`Jt@trMgC#~iVx0kF?Z7f4)3N0YPVHh;op;%XO zwO*j=Ojpr~>m2Af&Ut;V5h_I+uD>jFj;|-+gNh@gc1F9U;PuXpp+~M}ov3z~bBspu zKe6sMaOj$ZBD&bL#TID1Jw{J}%n2tW0O&gOF! zB3C&e0+S=aMaFM7RbP=Jk+Qn)@pRFMSVbJ~=K^ zr{lRdh1JWQes48cJ~c&7J;PP#Inwk;sDu09_+Ay*meb^TCw66ub76}X1 z@*BQ(rCpKYnJ=Bj?T!^LkCsqm_0GJ_CNcpICDK#T=GZVqOOqw|U6;0CrJNUdxVI~c zF!9x&D-!wv-R-C+ebvroP+IR3q|E-tGy=uVXQ)k_waofm!}AZ&8yNEe7>3QU`X^n( zlTpwXx9-?QHf=`S*UZdIC#87I{1_o=^R?mxfly3$c0f>2AM}=-mB{s;f(XsPCm_*MR6&E*#Wmb!ljw5IeRg zX3%E9H4TMM^P7?Fk@%b^|7qe+@FBwVv?iCPuEq=gIM-}7ch5oXCXpjYy{k=gNhwIH zHE=tcz+nMEP@~1zb+65f>!36IQR+;Qj9t8Vf5pRkWRtB0)1-k+>46D7_E*=S1(-aG z3bADk9>Eh;+NJk$23-8Sr1gtO6* zl$^aEo{&aYS3)1AGPTrmNSoDVKWO4@gY$`&oBR>mcKK}drrfU%CL7K11Cj!He7lGm zt(C-E)Z+9E<)%P{&COc+#=$Zi?i|Rch%$-rgk;pv;a>V_UW^auW%2k$pE$Y-?c(?Z zb;RPEAHn#Se+^f*<{+OIBf-gl_WlMv@!fJ?RlhQOZQruz1oU)%@EBa}j9r4ArLkYR zbol8r<$D)7KtYicmeNOCdPM9tphjC!%A6{vO`zFR=LIndd+zGLG9w!12vpip3Q+s`=7(k0227y6JTVEl ziz^VzT&l!k(#zaW)BhF$eJD<_Oy-B=*@=&VfpLCO;n&eEOp3P`O~YwsKECflU0|r(R7xKm%QNceflE8kY;o{1N~TC?>E5M zyq`HzKQ>mhJ*ui4zR3DEgGZeg8%yGr#DE%#`{}9vW5?&1sVs08#gT*A=@A;Z$SHT- z?lt@=YmGY`-33IHs2%g)=x~F7!t9c^^3>WFyKbaEFI~UHYXIzu@>z3o#WpNd_hKVi zM!I2Xv__Sxole(HPT{i$eWLA}Z(L!Z$!JLtp9GjNnR(WteEZ+_3~*ciiS?#}&rAe@ z8X!N*@g4t*&L8OxNpn*DvlBxP+`)-C8;V6v@v=$}>S&S5?0DVda`6*6upo!^N)l+! zF3L`AP#bQaD@Y!VVQI5b6O(b5$#T>BcMEX8I|_(&pk@w6w2=!$a*}y7>6q?BstTQC zzWDr_%)M)*D8oYbt}sqHIa;(X?^C+ZaJOOA!0GZ9LF<<;cSRu7v*x9Kb3mhp?cUZ9(LE2(ijS+@2Fd1Q&*HCnNRD1} zOLh&H-(h>4J@^|Ik;=zdQYPT4EnYC&=Z!${-vV>+ryo~zfOOiOvP-#&+Xton>Gy78F5 zXRS5g6sk7WnrX59na-~E=-ZD$^OW~gEgsg6HN<|tKagZ({pu?K|Da{)b54Wr>5C+~ zxSNazTDD`7Ii&NSFsF!9CO?<*N-77!nWhkoXEJgc%pd3nV=yH>Jc3_y*{85a2RrOn zJqMV*>m7Zk@Zl+X2WH^w5@?r*`tNv`(1n z5v=sECqkaJU42>8FphL{FZdpwFN@?>+;+9_z05E^#O_T2QK4K}YLkx$*{HsgbA?*Z z6I5SjTDGsQ#6J!%j;G6@;!m#2E^g9zo^ESt|od`gVLqtgWgb$!D0_>x|Zev_VO47G%I<;{F- z)JZN6ee4P3`^JKNQ^!Cea7Y_b>M8`}#=Dc&m@H1R=DX2thr2z^nk+LStMW_KP~jYN zIbxa#_$E)$qsrHt;S=CC8}4^rxL=hWjS$7Uwx)&nE2%Oh~#R%k+R*_m}@ce z!#`aOTHF&iLi2#fga78$in5sp=Nmj!3X3g%H7Jwzs_xfRvkr6#F^u#)liA?{INLp$ z@(Og#^dmi^e2x`PQwdDw+}=_J&d9np+Y)SW9usA8Zl;-qZGR-bYsLSM@=)gy>Co2siZoqJkTJ^R>Ra#`(4XI z`$4vXF27M)<3U!g47qL%2)eI|DbY76%Uf^MGN3H1ymzgz(lQg+e72+-TeK$O;`yZs zzj6xwvuLz;lv(=Bqv9!-_Opt%zY3U?XII;vN(3r!(rSBGM;vLC$RiH1%i_+jGzQD!!Hp*0UrY%BF7bFO#ibw0-ys zJ(>CCoC-0(41U?+^@*LVCqSI$-;MkyLSO(LG*MKfRM7Uf5_V9FLsAhZ4=ysHL>ehw z1kByOb&kban;Gx=47b6l22h=K;?xFXf}v#kLrYtFe3#cfjP8)BCjyht#S8EDrxqr2 z6!c_p!%2c8$pKIPO^xx=%^lQzGbK_Uf#r~`K#g$@YfgtKx31;>I0!EzN^~JTNW0*}k4rMkku&Rd z`?8irf1PAThN)b2<;# z4;Y25!T!T)u@tz;HnH5Yhx?J^oiWLld0mPmmgO0db1E#7r@G~jDvnP?uOVE66pLaT zw%r5ASJUwT?!U0~i9UbIjGNP!fXnBD*M7)nj*Kg9UX?x%`v6#9kFQ<*4TZMW#b%}0 zE=xJNI0<{E5ZlQEkFx%xLEiY(J1JZ!e39xW(AM1QH zFqlP(nmE&CC1(i^Cf~omH9`@l=~CVV3RQ(95}o{Ug8K_F$#+Cmwi0mpaEh$X6IDC? zy%KN-iF^be8ZuMjMJW!S-Opdk|Iq&q1#R^s>C5J! zhOtksO}wR^{eNdLAox*fJe>vu{MApqU3_!9)!(3)@Bd7mERm8WDZxLVa6E2$3&#J% z_x&}-jufK&{})Jzh#j5wzwka`dRWr`j{{^%bTR&4C?Fzst76GNdggCY5HrJqS^sKy zptqYPoL>2F?*P8;h8WGN@qfkqxTO5w@G8i_|GkB4I%_NnOwX&5czlog8KM`jDi^G4 z$1U}@hQB_KFu(twA*-mYYU`NvzHl7;Z13REyScduY=w7@A2rjrCX)0#^^rg5<|2?q z6RAhvWx9XfT1+mkM-|63MLoC_mt+KSJd^ zxv*=!#hqq(*0+gn@HS8GI&R)Ca#Ao08vpVkH=fxblwSF6MK!iR`(RF8F)(IF^ak7i z*8M$iSvtB))?alvE1xxguOVv4@4M!_2{B8AjF*^V{v=X{Z~NMm!_HZm^y_($h1~6D zxSA1jDr$UXO{W66VHM600BsOvshFoVpOPRh>o z`)6OfGA;1O<4py5v9~RG=?A>61+fZZ*je(HsbRKNDS z*ns*ed+-P1`pV5nm0!mqWsVaEg$=T>1& zs#)EHF%^Y!uhuZy{wR%2pAUhlyDkP6>~YHIgEuU*%)87Z-lLAOjys;I_em%8%ASl0Ubj65q<6V_F_j^U+Jn)5H=M1;EAZF zBiOWQJNCDgmiB_R1m426bg3s=;7%rBo!F0vg z)h+c*mSm${ccqBD^q}Cp?6^4{jKZ{^QDAz?fYd)SJ5M7I;xh#hu!31YT65{LUCPKghtu{Z?Q)H5${pk(wXyVzH}u^0O~_3LkuS)oXZk)b~X*^$vJc z$|W>T9;)Ex5i0$5tIIeJW zuN=usiFD;U(h8K0d=qM`zFQck*xM(G5`!U$H!vbo2n*JesiuF2#8tUQ zflB-Mu7cDNOmB zB7Irtr|lMeED=c3{SNa=e;Eg6t=$&Awe}xa@XZARpI7*v8C9J)Mdrs6n4s=?j#;X( zSN1e3-&uro#HiI9Uw{2Df*(L`x^fD`IcUJ1{k z)7iTm8K^fpVCQ=1M5G!0V`EYsyUTQ&O1}Sv-&Ih{g}me7*Xi;jp`Zr4{<7 z-l03E9McpY7DkT)>yk?ZDp%;@?sck!6b z9g=?wEodz}c5+Wwv`;`R-%1nva>^aW)$RL3h*u|m3m&|ByK%0IJ^bp{I)u~WJMLyU zGOA0*b>vS?F<}?_nqtWheum7)uglm7z4@11=9^^{wyi~cjnz_2r9LPfiM|~8wzJTk z1m531$2Z|}8X(IMXhljoG|WB5vVOGR!8e|HbHFE}d(U_l&kVp8HC<|Lv(~&D;8>4CvFf1k7?+xz&n+|ouo*?-V4c}zI zK&?yx3NFQ48Q-gR+{f~{RDjv`fPtkz;CCY@+9mN-Fsh9f3Sm*Qhs+f8+|WZR9^&bb zH=%c^+|6W}3ER$+>&T7`aMaTy-^yljqY2J%?KStdpu!K5b#keK?frrtT!=!t0R%Xd ziR4zLAz=`x5o4zKqC`op-so%B4-O% zbV$a8Z;})5k{HN11@N_+cX@DN+pPvyuwV5~Y+V3AQsjQ;VO#+g)E2_6zXQAc4PDe%M6|zDegul)ciDf6GZ0E2B}(a!2Ywj|NkJ45q_rcE|1XX7apG=7 z`0vvLxQ_o2&;$7Y5h&0O|MwqB&7tvsg$V-lAA)fGeOW;i>O+BRA3PA`=H_OIykY@c zL--#KDIUB+`5M(}slRMB+Yx{x;8zyEUA7~Pr7(y~OGl+UbG!Ea!%EU6Y$)G6D_mV& z-SGJMK!?ZO^&pO&{=sNcsdg(fJU(yO{k=0V#MJ0~xvsqHTu=Z{rbg{yzi{aTgo6fo zs1(Bn`7a+??US{k+K=80x*eDW;<1B?R7!F2@%~3Se)z!CI0vn2I>Afk!W$b|X|y-c|qruXHfdLWT_v?O4Zs$_y9te2c zu*^){j*rK+Yj655!r#&qcjP9^-uGcD}z=^*SG zXy92Pxmz%yb6{2nr|NOZVM!xt&$lbp*O5)^a#s;&TaqCkcNj>{XuY;iLMSCT{y)_# zSR#9L5d0XwHLL{5_dtYh76N&R?T- zz81YFuIGBo@C^zI>XZTIZ&jT=v-CD19|TatTVYC#RCp7gIr*T;*&+8mCpOHKg>gosWoC*3V{;iuF=hoHxClrG8AP~*D zJ&SV%=(E_<-{8h6+ZZCA(u8>^$5g10^=ffUF_@F9E7jw`FCM^G?`)w9iS~kEpc@Y2 z_d*t9m;&HkAT#;w(lD}J1&YE@Y$I2I8|5O_m_-fkFYynWWUb||<_S6D-a+Gcu;W{$ zNDl>#qz%i20ir*|j7G0nQ+4RSkqqgn{;L*7DO?`$NwL>4lPm-JF{pTB)0}$_13{$! z48%^~C;ljd95(CF?fR+x7$fj{T%g`!p9ejB;Jwylv%u=}>Wr3|F=3iiKU*k)vfy<2 z^ma2XjIeW7)2(Vj6AF(P(MT?f>@0@)(Qa>ap^Piri6;!c9=JAVD+lqsXwnwxc*eTDaXaNR|4#j(QOG_)9?* z7Pw9~hT6SW)cI9csLO_Y;eAG|Wtk4+`(v^?6Bk~L7rOpYN3S|7FV@qfqv0}2Akq={ z&sK)+kUYDq9-nNrIPW1~g1C2eWv8ot3Igk)pr=LRg;WGRuJ#eExWD=&Ne%}ojzj8x z_h8Z#HIXiUFVmFi3yv#O=g*|Hd2{Rq=RKls1oalLWB80rs5b*AYA3?Wbvsp?HRDv;71-d z3j}{`eo++=KCx{Y5+5bt``x8S2=ds7^YzxprQKJ92^=dc;p$D>Q9hLe3GrLsT zKTfsB^bkzp;L}f$s(M)DNZFm~>-W_>C7 z%{_h_eDkt%$GL+<@dZ8<#x@oMBu6|GaT(w^qHX6f&fV!=OT-X!xMm<*=`XpveCPLy z9-MTRs}rb6IV=F(%xS7e2w5}cj}ub7=elQRzEF>Kx?mN6q{LCG{Rl%D`R^o{4oNTi zT^D#}-wG)GT@MTl%uKNi4w~^;B$r9oa||BOJXp3PYBD~bCm|OXR#{n@rTKtF0(qX_ z=O41$Au<`eptqEoYrPas*lr9#DP+yY%P4$~wA!=p_`6?i*YC&GsB>dvt2;i9*)tRcaODetk39*H(g(_@f=QOCqo zJFu+Jd@Q1+OPEKddNmH{CEzeTWC5)u?8Gqjy9ihqi2FNBA9v)P=(FR*4uu%5xTo*@ z{!}Jn`{A|%Dvc#S2E%bQl~Z%s^U{wXunjzCNkOm`w##avJUE@rs$BaPjYhTf%byIp zE(N#iOdhvt=>5n!EV^rJKLoX<>HxFD?hu!&8o=0zo8kQF7x0IZh+esvzSok~-N_l0 zy4xHLbzZ-(ZH<@V47lK|)^P!`DHGy{85K7-M*;<|d&QK?*W`z$bVKQETH7o*h^T^X zVLK+1&|m$x>y%>S+_!z3Q9{Hv9JHk2!TDYxRjc(vgHb+1-2C`|wmgei54S+@iOUYG z%60pf*b9u;=DNBRKpv7r1C1x7nO2!^TbhIzX9BO_+zF7QCXAOOf{(>nkV!<8DZ(}x zaAw^sP3u%N%ooNNtG}t2tM$6O+RUB$f}p6cb!+wgAw!n7@1_LA6%~I;8d=QbgVop9 zE64d7j!I6S2^BRV7;HX=);hmJ-pfk$r zONee(V}2~QPhb9VhV9sAS$8oLh|0_f4w~%0(e~rRZ?6z|KIN%A<T$3V+01Ose)`DpqDq0E|JHc9eK5&<`@Bk_5yC0hg zZ8m3|Mc*6ROgp;%dYQM}NT~r(5^&-(K$*GI5=zVc@LTHLj;?pZJ(Ty7J9Aem7i5S$ z>D?}@#(j@?_w$TfQW(W&n1ZVDPbxcj@j?I>|4f3WzQ3zg0W&ZX@Ht#!1#|*jz+QnM5JCoW*Xa$RB-8o-P`gFGa8-K zt+J1#p=tL|U2K7#5(jvUWzk_gf5>K;UZy;NffI)dZxl> zyR=fgFh0FzvFi&EKva9q( zsi?2No=nNOzTD^M)U>z7X8;NcDJf@4C2Wj4O5}5_fywX@gK-G3JABAcXRs#jUh5}^ zl-eDfsn?wEvPGfr(t~TvaT)!#sskRl8TR}vX@<_2(vQ{50P47+MQ<1C2kej)CS2&P zxE=>rexL2wvD%xY$HshnM_VJb}H>@L3l+X(_LJ8OdGt?ydlIGm#Wt-jOg|B-1A$GbSKQHp;klAINd64-wBr zZ82$8nd}mKv9)be)SG&aoC$MT`c0vGQ5XpqVNuZ|>bF*`-a`L#0G+!a!F=pR0vxEe zUGjgxAtMJ&T_~sFfr*M+aV8i8GoDk96bVh;7TFc(^-8z&NoOcnmy8I}2MbT^|(L~Wg` zYC_itfaWBYb5Hd<;^GA)A?ruP4-3vvZ5$S@Z~H!2Ko9so3)F1Bo$J{+MF|eZJ#QLO z=$A|^!es>t6%xn`ELPkU5{L%@_`Vqm=s&(Bbu_k#sO~Hlo?PbKO4eV8HB54PpnK@3 z6W`PHyBlijZw^DtFz<({w5}VZQ$kb!fIr% z@kMIOvjBBpw_Qo1i2$I&;^%ai4o8AVY+dTnj~x+uGWDhj5X>aYQj?13zT3dbcqcJz zh|Wjj+iC>K>T2k^6DFBmnK-Ue2rDC<$>|Xh)3@ah~^7n1A*2#9cDWhq)Vq316H&}Mf50UAqouJyaE8+=cqp&BM z#P9vee~Zsw!xgZ7Y4GWL1SGDjcD+S5lV%xz{#p)Q{R5kwVPum?yl(2wFHLJsCP0%v zb#gLn2_R704_ok_x6^fE5|zr2?J$mpY}L705~M}nl4bMqet?p!4zty&Y()thBJ>lN z0K{^%k<9#DWnGmmROhnD2ryUt7{}$gtydb-epi2r}(jqpuQlD*_) z_JS@_iLVMFu)5De%#Nl0gDqC(8E;8;2#|KR(kMRZ%i$~H&QrHhvfgs+E{b=N^``Gz z!z)>Zj$md|syAJhNQbwhFxxLS6yyuph0ClpxUWlULXfDYn<;*FeRujHz57uyceW7F zF(}QiXD~#NM~$%-^n}WV-&$pTrcNiZ2>B^(-gfV6Waj%#RbP!=qYD#* zY3xGE)_~A`7SX5L#TffOQ}}4PZ(VGD?z49^zu1c(BW9e_w8gGNgkfuEIrfWcN457v zA3*T<0bGTH(v@&&#L`hOVqIijWhzA*3DIU$<2SLi?_}r`0kWLnv!9Blx3zDD6{___4LQW^VKOB@9??~(NSu61o*?iV-^zc1i{y0}u$9*S283;Knktpq;L q9tk)idI&1w=UbL_`ofRw?*ff|SG*xwAfaD?mxQRSNVSlD!2bhA!Y@An literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-template-selection.png b/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-template-selection.png new file mode 100644 index 0000000000000000000000000000000000000000..d523a7f6b0c0ebaaf8b5c66c59144d3a955195e7 GIT binary patch literal 122681 zcmZsCV|-rC)_0oZifyy88(WQy#{+vB z&0d`UgvrZ_!NcIdfPjF&ONf701OWlv1p)ce0R{2-WJMj>{PX9FqoSA)NX0nb(PsnP zR8U3`1f)6!_EjJ7*@m_gS9b&fL2>%~_hsFL&y}7FXx|TVy1AFVRkRS1+-uPsiEnY(;k;0erq{Lv_!xI0#r^CL+ zexE0PNUGoFg_wN#mgt3Z71{iN^L-?RZ9;qt_b)!Z7WPd75!U ziRy6}`;WMNiC7GB^~%iin;V)aiFn4h{F69O_jbuX7k3PBHr+67HSYAr{4*d2o%@Ge z#fu|~$>|T@gw0aott!dW(RUd&e(2smzI}#~h@^#I5f}>WCLSmns!hx@3v9yP91Pf# z?+5ncB@7e4Mlu{#DdG@T&eH$BadEM6o41|rgnqN5rK`?x-Ptj=_HuI%^uns95Iv@M z_O#bhtX=$JCD%1$<;7vIQ6@tmpaC)8^Dc*_+mmh38Xv{4kDX8Kj#&&zuJ19eJ1^G5 z;fBjiA^CQrvQ8g!pw2JxJ8g2*$ADQ%Dm7k_Ao#;A*FR(9v5hiGvKn%oHcAZVCn9Nd z9K|KZeT+~}VAKR6VM-H^gYR|Io?yQd-)${RGGzr=vo;RlNAF;_Qoj3^TPq7(7U6mj zYppNJepU>RecLO8ZMPDRy-Z4+*S(dIws*d zIRdE+=~1j=Eemil>8@0%)c*Dqp7LF-UK?ww!EX_kI1ot)ig@=Xjq!z$GHTy-6r19o zCxKpQr!6#t|5F@#*VppX1-ivFv?azKk9> z!rr{=Ll-+34rK1hH!UQ3#ENKb_@hIiXBAbPqi3JtseZa=@7a{#xf@Xnkki`Gr1qwOB-64Lom64(&{yS<7H#0&2?h~%d7*)Pv}%{wFHTJxLJ z4gC5Hjh(O*jmmbj?MlT&Qw%o;JC#28dkqhm&gKxSGw)%(@9GigrSrM@gSBRN<+RrE z2%0^+$?TJhtzBaZFlDH;_{;#XWQM`zJDOPGG*Af6H<991-o8$Y`u%2@+l}3wbIZ#6 zj+MB--v^=WE7lav;?mL|nXHM7mBuXCVRuFwwsa=5Ng~cYZK@4=BHh|QnAptCTMH1V z^6iH*z?<^u!7nNDB?>srF<%qW6}oHi<@%Copcq#1ySd53tua+!qu4s%V4|d8nz*>T zy*`Md-8XtRF~%5;roL1Yj_=~XnkyXdoztNy1f?0M`(CP2UbUZyrZ%3zs{K0R z*iJFF^p!10XFarBN0jK9R)fvfPbCjC;%I_Wd9nocMn8oY`BJWQ)gc`Kw$xUK#iMJ* zUAN87)8dJZ|E@;gu(8IPGN#IW+HQ)xqFSyMWa){KZ9jwIMno270&f=WqCH45+Kq4V z-cPaLufI^H5#*Z^*)_f6XYj%-*GNRWl7*$shqEG7@Rj(Hr$HNG;FY+1s_h4ELtXsX zjSA`EyG@G_y=~F&-3Et>yKb3KiK62@N4)8Nz_4qraiCi-yY~GQ6lS#Ahp5gvdeg`@ z9#P>SWf0nCi_4V#+K3PRS8d(obt=5vt=1agF-p+ zsJ}n%OceJJ&NRSk`*M;dT03YqVbMKY`pbC3Kr`FI3SA!W_f(33=eXxY`ezm((#NYb z4ZR1y&IlGU&uCT=5Kszeis6~KD7ory8_!?bh5hUS>#K_`?}WazB4&H2Jfwg1rqi(^ zkjLtIwi8U1rwXXzjVIH>=_P5oHfZcDK|{8w>P!O;ho14VSA_XyF=b%*6!ELu#IcMd zYCswJrejDk@a#etioq5H6Yk0g)mudMbv{ST1bUreM2s2Nc!v8*)rvdxxUV~j3GCw- zXsig~=m&712tN8b>+bgA*o?ZFFUFUx4C_^2aV8w^BO|D(1>D8P7FO_NsUB4ANl~S` z*S-g5k7-Cs+aw|gl`dI{Ff;$+f+a)f~4 zWG(-eNe`Sh&Ud>Jj{Mc4;bw^NRECaR^kercxr!jl1ImNT!9WjlHVJNdpA z`CPs?4Q)m{B<#UUj;V3B+*#SQpW}F+@#IopNHL zcf4>oELi#v-u9E=W;dq&b{Ohl&GH&M{qM*2#}dLUBSSMkHy~8eU;%F#qg5_Xwb|NS z#hv*kXB|;doe15rx@_C`Hk_DCRzg97C)xXBE`Z6dOYo^Og`A;~C+~vQw=af;1}E2a z2DRd6aF{D2%`K%bF+GXGiqZVvSVT16;O(`JS0z$JN>~T28hVH@GgbFxQ#T+PtRsp) zR=#+K97L4b$yPwzTCU*J{fZWR+!0=!Y(OL@W4ERPAjtBB@PM;Bx9>R@i9FZTUs{H* zGz~8QuE&dN#tptgm}r~p_?=K_=ZzCAc0X`ccYATRpb z!VQJUUH3f2>R@%$!DG0bL{!ux>OU3xrM^zY*x5@c%90i&xSJ6+7Qx`e>UcQs#M?#ee~cMs23K6nIn4t z?w=V(?<)c<+e$t2Fox@b`zo=#IA4S3Tk}g~aOH)X%M~*Z6|bHW`D))YWK<7TNxgG$ zo=wXq^xj{n5jsOcuD8M+VXD=3*UHivJcQiOCOxqMRs^T4p^>t*AKoKoey}ezls!l^ zWW>uCxroaN@?t3Y7GPy+!|d>7E=|Q{#O9W3EwKb7~roZe6l>(3bXM>C>GqOUc)8X_w~ee}6Ybd-Fe{`%jn zXxRsc-y10`w(nk8QKE2%8@g7V-Y4^rfIZ0|6c`<&y$4yD-Td$D-Ud^356-(IM^G7} zVP+WY>7!ivcHx3RL0CH4qIo(7Hn~XU==cC=RuSzHeJTh=;u$DG%p2KCCpt*Wf1nv5__wR#2tE0 z#Ee`j54cC@-$?wcQ!4#&Ns36m9>+0HN=OqIfl(24(zoJk zu?cE(1AN$_D2W@vQgZCxVEyHkC~M?|HgwSKYzGmPHSG!bQ=G+GK`TOO=P{PF$`aQTTQ+~!>Bi z-hstkRJL-sSz&5;TG*4$esz(v(d5xuLn*&_KyNhmPhQfRTA+YI&!o!_li{|lnc1JY zG4l0Z+Hk~u&K;xlRi?rWa43JsR&w@K)?aB@JXe!0-=U15nM%K}U!U^Lo}LG$TAhS9 zG?xkZ4Ls&$V>;aPMJLbkG8)d)L-i=xKR50<+a+5M5+>LTCRlNk+hF|@uaaBTU>dl8S0`2wPldF(AN<9*v!XTGHtwv)Nm(l$vhX**Zk|jpoO{)`LpH6w zds}tl7`&$U+cj5*zthK7Vj~W1JmPiSBNk6~C}@-cH9%TZ(EB^kMVJhg30O)JASR~` zUnjaPA_Xt=Qceird|#oE9d6i9jsUacs#w;I8Of-hbdZEP$if>-?=OE0|1SLb>Nu&4 z6$E**GHe|ttCk!4!{*(@J+V*c!V*h`uO2Aycfd8gLa6i4wob*P{FJ?aC_oWk2)adR zsQjmq6)be+C-UDGp})h>KVcBmlRug~H5yt1>R-fePg(MC9*#!}EUz zyH)Gb({VqO`dzetUK08_HM1a4tOpPCp5^b8^(^+!6hn^SI%hd(aTK@$(-%9h|4u7G zP-)yx&i*fPAwHS{{}SG>|KwJ?5!EnkF#lyj(QV7*{~AR@Fn?tLMXZZZsUHOTk7z$d zf`pqy{BOFqJEA~I74qK%Pm~x#Jty|RtsZip;)K70KUX6nUmx-hp+GM|e6RqIIBp1}g>vhk~M zDSxu#1wiAU&?bwt(8jFx$OC@oV@n@{U}tCN;Nlvlvekp`E@9fSrz8S}NuoGzFpnai zbL@ONKl-E2VM-a1^U}*yA_>EJb%K1-j@nLc?Jrww>N5DPn!j_8`$Z52! zSZBRoDu*Y@^>6tR@4r&Z8azBYp$vJoG`w67uX8z?bbL~HdgSqvZ$5XN=Em}7z)i~q!~oQGv+rt$!}*R{D7vy&&K-Z3 zPe-g9l=VG9b0Z-jI;yM8KjL#Wl&m~BBjGYu&CyvrVTNMko6F-Zq=I% zm(v`Z-1b?b3Az36c79cZ<-j2j@JFIj$n9L;C15=p5;Sj299pvjX*Muv?d;yG3W*BY zG6a?#)-IK(-giZz=OEA7Cl)z-O&SDtVw)hT-04c&Gzu&CB70Mk-lVM>M`m28&$SmL zQ3y1OasR4Dnu5Ul59n?YhHT}#=Lu`9hj6+p&(3ED+?&TQ7`GR}Y}U(qmu={wu?Y!= ztv*X%z5*1qajsY@@)Cdf!eLN zUHh1W*bd0d&(2~i2xpU)L&|ua58~%tsXL!_4cj`~6@;~q)Idmb&Np~Bdpg|FKm5pg z$Sc1C?W41RMnH@*APZLQ!-nwXUB=;38FsMrGQIOR{_e<)}YGP^@CjsD>(=3 z$QIm-mOItPuZ(pzOJFx_8%ZJJP96ic*RP1Z#Uap+iEx^<`;o_fL1M30m)mT&R#PbL zK2P{t4hP`to^09Ltu9s{r$MMXUp}{~Ao%S@4^ac**Uv!-f^e<1Z?N7^_EW7CY+BIY z`{s4$MGHG^f`&Os48DGq*R{z?^HbR)8PHJ<74i-C~QSn#Lt1#d_&)djMdzncVjJ<&@`MT4Y;2SNU#|1 zSaCZbUJT_9$%rRae0^W_2E0EIZeE{rnkgAG;*z3zq3z-0O&QK`@?1U)ra7a=X{VrK z8uSzEUi@IV2jB~;i;3OF54wAtWewS+z^3$djRmir>}UIq;1n$yP@V@v7_2k!=a|I! z6)9Iys$^acF11Ixq|D~2F9y>WoA97Kv(EG#1luLqu*lQHzZ zLV+!MEVf)U)e%$>iscP2O}ekz3s7vXds9_;-EPv`c(`|eAZO(i9wrL<5e``Ooq_nS za&}daQcT`yRJ*>-|7M21`m`_Ue@2~aaIR9f3R!@dt*PDBPl zpo#^Na@}gR0WTD-AOy0Gd^d_x) zSy}&p_IAAsGm0uCZORq<-+CA?n>)9d=_q&vKh)(-OXY}AmjvsfkD6A9M1hbD-n(k*Cb!>Dex&Q}zgO|ue0=br2Pp(-dI zSKk=hlqjJl9E6ibylcj(w93x0a)$4ZpWfM>4hDWQ*4gil|8W7V(XE2{7TI%-^hJU$G*s~`?I#sL5K5r`rN6-K>6&g@E z0YE8pJblJzAkBUhUQAdn1Y~~p!qj+25$m`R( zv~r*B#;HPH^BC{zT*%)>Ft0T>`S372v&TK{naK6c%Cu5%&6)Vw!LeuB*UOE$QH58z z9dt+W$RWqiKMq0)dai}^Ql%a_bZrQ4G#^$z6x#>|lt-zTDojEF-VhZ+FycHp(CF2I z7T4~}(WYnRebX?i>-}@1surO!T#x=35k$Q^lnkx%k*7vp8M0>zs>k%5BsdD}ibre} z#@k9LE>XNp+Z*x7Ss!b;vyr2+{rPsV#;`lo%MDrr=8lJA-N>)s=%=6!e~lq}wq+N2urdJVhOW3JQxpw_qjraxcuHYD%P*pehw1~WjW#8$2LBkKz6 z((L8C7OLa4@Z~{?-tA*EzU|+1fe#9>t4kULV_fRecd4Ie|EPiWuF61~ER7FQDb-C2 z2X?O8>R-BGySYDx+hn&7u{x3@cy)SDyPjkbCSP;7CD8>2MT>UV;s(87yKeNR)0>9+ zAYZ4&X;h7R$w3cMQSnE$fbz1fpB?6VVM&F&QH38rW<}2cX`%fHgEB2xwlpPTEG>rk zunbV?kIf@zCG7iBOG156o+G*{CG$d$F088I%oKCe4k393A}VgtWmQJ%yCp7gnUz2$ zd>7Q$uYUfrmp0QA)Q9_e@qoNSt9?BAj+{QL6I^LNzDR|tylH%0ebM`|il3NIXCi7Q zz8tOOEmrh6r24b0bfZRRvbZ>#nN-rCu4kP7_2_u>?dx=p3@H)GuMHbXfcN&u6BFFtoAyUIvqa+3@v7@fGL1$ z2VVwvAK}4)ny1NpBgZ6VlU?Hv(eE|sEcU%HjI~{N^*Z%nOID0z>Rzyw;9C8{YlW8$ zeWb@Zi1ZX`A4HBCvo`S|8@L_uW6!V8(%ti>%2sd&hKpm8-$r_L=ip-uZn8#U>!>3D zF;O1*4pMFA;?%Bh2ty@af#rj}`W+0K8(LFj2->7~Kg?w+v3|?`q*q+`)ZK|r` zO^4*Qstg^}5wT?<_MW%8T)%`&#+Ql8=*Y1Gs@h#m+XFQxMe!(N@XKlI@E;E>z^l@u zUfx}+?2S}UKTgE7eqaiivt=eT-*5F5&s^7Jb{8iUR@sl6HAyD8vlqkog=kotkTZ{~ zld56XVp(;b-oaMx-ktKIMzu0w7>)F0DXR4o*Wcr;s&m3v${F`$zT{kXkd=qbIBI~9 zo4;Hi)49{P1lv-`CJ~U;bD^CxAr8s`J=iJ>1GR)KJJCamtS4_@39()3qw5>83y={xM8 z)@smig>o@Y*vw$|t~zdiZd&SSu``xx+Nv@Z!&xoy$RQp-)pRHX2^{xRQ_*KQXQ`A46Ba!GK#%6NW3k*&*03Iic`cP> zqeqOLq*#5qxD0e4-cp)GXCi~G**+qp`IH{;RJle+_9G#VQRki^Vt$4kKrO4YOwC6_xg6iePDHJdjC zoam)!?Hi&TACxHZ@U^p>tg>et_dZWjx~mic(rTr4SOEBQ%2KQOhE zt^5VILL<{0bDXeU=T&)bFTb3IT4R15KXViEz@Q@?Wi(ko#GC}3<*3}A^x6C#m8kLSM<1FOW-H#u zHth1LJ8aAZv~W?ny&lIA$XXSTuS*u?^%H3Oln3PXS{feH7jwWLc)C&JqYYgORJpF07!K&%GX|Mh6@r)ZJYE z;@~JFH#u$p+TiGlC@Yi@-uYDtH7bxF8sPg`ddDJVwC)w#I%eKouY(()KhmEd~24yx^+hSVU9FTd(q_~uYVNeXlC8~ z^R*bb>!X-6_)03CL{*M88zcr38Wsb28otvLW-RV%#RfzfD4_hAhUp(WEeoIc3}~fj z94PrxpBZI36ped1WEJun1(7W|4mm{kn}+GZAeO~f0?p=@1}7!zJF@#KJ?j98YCn&F zH05X|C8+_^WiEox5HVt}ZxRH9$OE({Q@w)5ZW%Lp)No)<>?)l|x&6?KFugqx;>%D9 z6)W4V4TNX2=l*l;q~$7GqH)BG&k|K+dA4XfDE6*BjY9i`;$lrcW)^i@w8TUf>i3RB znq|j3>`1CY!Hn0Vtf*SijRK?^BcxU_F%4v@WWVH8c>B|PB5Hdc6<9Tf&?G`nvqhQy zHB{ej^~?{AyoT(Jjl#)D%%$iBQj+1wA}mse##ea$WGGReX8woggxJbl3M6!h;y`J4 z>GLE2?5};a))Wgq#DW*wu7Pv@%?Fc$K9=_pg)>a>d~pCfpZGVpskqS4NEzDcgklVO zYwVx|X3al4^7@nEVrmZCU#~AC&A=*Y*1_LO*)Exn7#)V?n)vF&I0$0eypfMfjAf5~(U z)0G7HDiVQ)qDw7h)Nfr`3kAa@R9G+eyGfs3)#q_tKnI(WNEKw1AVNl1b+co&*8;=#mA_i*lzm+^3wemn+z zY#PDVt~&!(8IBRd6Bw)$sNJmxfIkZZQf7d+uApIsfD*&zTS&qS{>MaC`pTL z*Wlg$BNPwa<$AnEt`UN3W%O>#X83F_BhVY0P)#N@ktmthHR*Zw&#$aTG+G2lz{O!^ zh}yeN_yCyzyaHDt4PySid=1 zBIg0Gp)Bq-N8`l=4~G*JFL)~X-)8p*&tYD>F(c~_*~-;tzdBjIc@7ziO3T@84&kGf zs3Dl+Wp0q_k`rwXQ#}SAZ)L8d2JxKPZ5l9AC)4=_3JPCj1f}rtQlsxO>`V3pwAsC_ z8|u6gn19<7?$9z%$nw?1Dlv5y^C}%vo8f~!=MNWvnJ}PCmRZJtCh>o>+e>Cp-mXa$ zB!AlB7fR&6*YypTM3?NMCkJ_{;O|DXT0h-$kATs;*+K=)la0XZA0aIj?m@u!BV^7G zbohj95z4E{{>2%sZyaKuP!WB8T&zSC8@Xn)f40LX$y@F8HMBXS+SoB-RYy({gj>Nl z?o6FIuVz|5E(F}z7Q;Myc-@B0|M7QNyx#ce>cqRXRqDv-U%vNU8W8RVEYXI-n4T~{ zJ624%MILga+R#BLFn$(zc1ck_i`Tog@-2E>?*WUKmOnWCypWu!X?eYnEJKtNQTf11 z(Roww`;*+Y_rU)aJPor`xS*e;l_}MJFV|l0?+O7Q;B11)-76vs?142}vYUt1W^I?p_* z-yzPtKm$Ys1Ofquh#}j)kUe(%ubs8FSGJM=miS{Q&X0pUv0S;DCuZJUkD@S&;)@ec zWk9__t1q8NF8X-9M4mmBK&~JxzY)IA81|5V^fAczf|DnpQTR;1oMF7mkm zxs|L!CT7BTt(25})lztlD*FXPb^1g6q|84+^iQYULslNOYUNd`B*3x9=;^}f>|+7y zbbfGr96`g{A?XJTV=)0P8&9C8f~y;kyMM#UMK8Bj zkmOQ9Og$MRPgvK4rgwGP*a~k1hVjga-Rm~$AuA}x1+>4V3cFFYXiN0krJ14jvnOa~s|HqQgZo|$Ok<@3b;9Ch0oYTVcDIPpBkAq_K9kn3++L+57rI&cFsHQ%nfEG8Nf5Eg8Bg1W~LqVHYA z3z_t=G$&3ff_jMyzX$@c9Pm2}7UVn@Qqc$CuuPlSfX5;eQUOhA=OM28vm~ zq43`K>zSwcQ(8fF=i^>Yws0CMC$v4bdK2^kn*+R&A@F$aL1^CU9}A+n@9}Q?sWc@= zZGm5;lGg%bc<95RnOz}zh~>COi!)KYO?3s`?%~wrm!R9C3(Dn+uIZ#i;XNskyTW;e~Yh-}Dz6C^W?4`cNhkD5aZ< zjGI;#Qz~QvTG7>>BUP5-m`Ff*5o$Km$K*0o^=L1rdLQOV%dV6*D;t{iI_yxjCo~w_ zh3VbSn!~`RL{ItlLr_)NBP;jAI~;AQ>`SuimNtP?_%|ziz1!s2Rc>kQaGa|OJnb~W zY{Ov{BETwxUb=jSG}O{#j@*lHoqdQy_V!GN&E!aT#~!)7sNWYk`z3yqfW_CcyQBjOXbMQyd%Tt?+0u*6OC{JI1FOj* zXEViNX!CEad2Q_g9a@1-WaAJ*$0btR;yOE+NP*ZN0E%)nAF4!{#o{Ep22*nv4SS%* zdvMmMgskf%)zu_FTFPr4W9-<32OEDQA@0&8P90?m1Xn#o|8(=_XF+VzypA$MAz%=h z_R{2}#9e}oUwutsU_9~!0>C2qMb_$9?R#_h`O4cCuDL+j4=}NEn4^p&TBDf3V9TjR zhegbGL>@skHx~bdz5x|ndHPQ7>!s4E8V8*3&mud|Z+5%GSqSvcMF@f8q?GUjorY4Iy;?n6rKF7*U7iu;i zjLFWZv-Rp!I~F_|b;fZF*mb#rjGw;NPo07Po+NuAAAb$$?QE!#I9=7=7Xa<2Ja>b?H3rk#`QC(#iG5w;E(7}$Rc$~`PHZO!<-R-w`7El zLzZZQq3u9B49BY8?^DLJy(@95S|_ez?gNq1ZNSDaF{a~0aInT~fSukbNDEc3zSL#) zOp9O)-lw5#XNa6TY=V9eRTxx@&0cF<^`|>G-uXZVgG~m|+U*vXnpqXS_)MjvtihkY z^g3E}7;KgoMc2vFiP2D|!iN~CQtq#I93+8dStbI_&J6(4Lev2r(3dRG2XY&p6qw5) z$k`A&sPnfkVDjx;y6PI-87qbLfjEj#Y4Lpn+h{2M+7a+BmwBi_vsn(3{tI-?IccU5&x` z8uimlxe+JIv?&Cg7#XN-IqG-I#p|}VyMN#Xd`!5opzY^;{T;Y+R}(>ui^h_W88L+W z9zpthaYT4f;bO!XM!X1N{m2)EYTlf9SG0H$>}q-_c|u?8|FDgyF=AO(4foT5_kA^w zj%F7=iACwp=wZ5BHH2Gx#xX?&e`6a|U%VWLMTc z^t-j2(2q8BJoyg*lb*LPnnoW=|BI)8SsKuOYg_o$lMZxzXvE6(6;$5} z+E8K-!4dB%^4nJoD(03h8RAc197Hj5=OS%X)_g&`Pp*ZJ|Kl3_8u4J-EBugarIpv7v8kC91ZE7okbpy}-Fe6}v3-YAG4 z9AG507RnP@pt5bQ^BeXTc7arNMY>%wqe0Oy5d#Xo%rM5TdV+1BfNzUi&u@&6fnfY- z5>%bDf1nNQV_Rw4CBu}(u?Z*kL)NekXN!8~W0+WQOjJ#cs#G_p^2`=jclTqlI0~or zM^7y;i%!G*U0{?)6F|o$VQnBa<46nOTbDdsoMyYU3yn|ukxPoyPVb|{25xOA(^Mj0 zU4@X*Y=wWpQOUD88_Y57$LcAo;RS!N$|7=`iYZU@1?UsK+OtFhuw&^nXomA=s@+2a z{OCgFyAiNiOinw|0lbNnz%{^cGa842#zF5+`PI-W!IU2C`r754<#Kr*#^ufPbAK3v z*tc&w>mFNAl;BmHnp#q?gf4_VS*S)*#ey-4HavIy#-q1)XtBNsXt95xH@i3Aat0qQ z4=*((5~UmnuX1kv5EUE~uqhx+Qj~^5aJUV@KGTQ4@%hue8Ka@NLgIU9H-~8!G3ov7 zD0O38j9=%8z`u~0A$GAZp4_Z_9$^+ipt3G#d_K~knuW?nd(3X>Bs3 zzp6sl`XBUh7o2A8+-le0(u8(3cG7<-Z2U$XB|h+DLu^7MT(v&WH_+- z{`PV>l?OQxh5Jypky5RvMXGmoX@b>szg(LQgxpC{y%iZzD0PDc?ERCr?WW(Yf8k`v zjsIpWDV@oK9fiY+;y9E-uN`hNSE4_iFJU%chOJVm6UAydKP3D$0C0p;0CK_XX?H4% z<%E-zTBdk%xqFX%%IgXV!-h{VLX&90w2<*JI~<6V0bgl+Mol(*S}9uyxX70;>3gr! zU@KdtC{!kk6dnoAVa)oQI0kx|U#O43Fyx}(;?h8D^FX%gb^CL;p5wK(w=>yo3c%sA z!TI?37<6istBi`MQtPr(VJM%R>J`p~3U)ls6y>1L%o@1X&l6a9Ge+ZcMv{uf5cg&K z1;~P-TQ&KZFbLgQJZA9wc~dY5+h&1sS$;xsHX>$H-m;Cl*%908@9(PyczXVTLE2qD zVuKIX>`h9tgZv|!KriTvy8>BmZf>n6yDxL4s)Ofity2Y3n4`Z~VR=38`x2>?CUZq# z-8?)Dp04+{r80RKvzQEnv0^(*XgMdQ8v4Yxu4W3M;Ne9M6DUH%8-@CV6+Sn_*OkH| zu_AO}Of%QGcA!YUh3)=PbF*w}$G3br+bfE2szgMp&PEM2gF8y}VZD5+%ovxYNF9v% zVI!c_5+-ncF_4_KG}nA2*=(u~*<#irFhW0ivV^MeU!0s5_OPpWal(O17MHUm+<-f_ zy$)W%=U#4)097lrkYB=LVlYRdv-rGmLJ;tUGI`uDJ3rnK|7u)qZSCSjgp;gI6K^N# zwDJA-4zH(JUPle5j}^=cSr@yyh~Cln0K2tXTrbi*WbCZ~wj+9j%dY0oMn{O4LRgm5 z2xh^pOPw`Lv4-*Q@AHmG1PppIzH-v3jqvvfT}2fE@(x2Lso*Yz227g^JrK79wNU=i z!$to<2xA$9-4-km=`dhn&?tXOCQ<7jjAu0Yym2kpnFpk%Vl~Hn|GadC;yAWYp&jx0 zZAS>U{V|Gf<(ojm4O?Bq?D;sS(`xrXZ#;iCv^lT}oz~3pIu7xDGq^gb;uEJh)R#Bv z$<~D=*Y`?0Z^-yK$s@|YzvYUh@*$JNEwAp>JGilbl=KW29rZHOpv3+fUAIy z(twYeM;2z&6_LLLQ!7`t`WG?iMI7!*D{ND{w7I$Yvs|+=+?PTYNa-rEULcjyhspCP z<}i=D<8D31A?-|4LxuVQGS*KO{ds#dLu&YY)XsIj#{xBblXDqHpg>WmTWYC_h0Jn) z&l)_42w?)uJ7NxI9-6l2^WuTY8OCCB!B1XX0&*}bgd;|efp4_hZBVfL6aDdIQq?BX z++Ag+h9v*$@y!ky>v}U>a}uDfjn+*|3kW3nlSG4QG7hA|kdp|9+%l^;Kpdf3WhzL z7r#RagqzLN9vnAlei%r)79{KsR#oKq7kJqLM-bNGC@_At`P`4m!fZSo*x~(>YrWFo z5dJmC1zm@aT%DGePc#OL7Z#Yncw~r#iW-5H02@4>8R(>HLX-|$8AJyETlY_NaV=!e z6jlHwST_3~h2}YMVlEsErc%7BRJc%s9gu0g<(7@D_9|RuE*ZcQMc}T;0I|qpntt%>CWR}(!UFygE2^~^k=Jmj z>oFe2RVZ`QezcSI^a{lls1f4vIlxI_jP-tAN2oU0K^Q&M1!K!o0FwV}tFv$?c6}~> z0x@YM!aEoL1lSU!QuLqD_-f1BG{8`*hT<70n;lguff!(;qWQl@>jm z-W8cKp_^<|N8Obu_v<$DN2gXcn}lvwqUt}waXPwGI-|CmSJOA{<@`Mo!i9bvYCJ3h zK?;D{$%YO3!^3{yX7c+Im`-H&*BFmvFP!wJ zd~=@*g+7}3E#vuVwV_98H)Wv)P%pDr%_QN@-Sx%?Cw%u!-(YAb=lN-JLAzlBrfzA6 z_V=a}q5~k0cn*Luq~^Z=F`LL2>B8fVZBG=3j{BowR!cQugrJh?Y-hDKd#`|rz}wkk zrOvA$*}t~`6Z|VhTk)R#ZMSVvvL|MtBYyM8(Z6J3587S-gX@KQ5+J-*r1)2!yTS_p zh5KTP{LgPA{m)ZVf&M4tA^rpt%Om`E?a}{V3)2OsnzV}#7wK;_jgHyfZ4FCaFR zf|#!k_H&$$rYV)mkjT$u+T7l`Ygi?d435Z#4L88PKxE;YDb}-4zqP5I@4$LEfE1h{ z_OFHdr?y(rJ)=d4bVkEZ>CNIahosP9KZ0>1EMBEof|2a9U_|E`BlzGY3KhF3?bbD7 zVz}WZ|KtvJzmYg^MR_wL)L5YX*%K6=%hF1aNdE&(y(V!WM@(f^iy3rpI9c#x?_jrs zpUINe=0%KDzJuNi#$N7CFWkdltePPtRSrSUWYC=ojX?+0csL35p?lTcG501_#(^;F zCoy=QC#z_^4l2?M21WEBq7CtWH9tv0^AUR>WS12iF~{+m4Hu%cWxzKp^^yJ3=o=;n z5^%Uut-uUh$sDVCf>6o$FPCfvnS4K~NT6bNIw!~0d?5h48>|J2@a5sGi*w(z`yniE zjb|Ol_gN!`@Ykb+iv5G%=8B#oL6Wl_Ih-CD zqxq!Y`P!s2$mMH0Jts2JSF&`t!vc{UKd`Avi53T?URRz6f7#i|_<@Q@=Bk}X8Z5Wk z)h$%}{*b3qi@oE#I_ser)6(JlaG6hqc} zAwHI@spfi`IXhZ3>&0N=o8+adAe3k9%Yx%oqAgY|xf<;YpFz&rx6#!ED9kqrQUPLS zBtXJo(u9#@9u?d&4A~hnJUV8SK z!HWi$0Ke(I_g(KFvsTt36Ec%C=j{EQ{e1QdTgi_0)kDH@T^6N;^-HK5GK|x-kP0Da zed0l1Y!hPci9GyH@-c@&tASQ{u6^t|z!>H`^lH5U6~4pFp%`TRT;uH}D#PE+MMMD? zvWz}3;3h*>H{1ZybAp{xz3(9t`fzIxjvhG18aQGl)cKHS3O2ljyUcj-iy ztB((p`9ga(@1nme4VxQA)q&q0HnG?zW^XF@d#6ps?E>X|51Rt+zA{3A;^@xXIml#7 zGLq8juP}OJuMjA;`L$If3ue6ISPIUm|A7Dkr)749@Y$8nmE6az0=XE*SN-88d!DTm z2+~rDl~TRp$7--gY69E_Gct8eHjVaoQQ8&_dm+&cxxokcNHjl)pGNKtnD&>s%fa+F*MCM!?-Aj$( zvTk|iegHmPcJ7%>?D*e zz0MGXt?6#3tiY>zf0w$jV9UHRxVpc0&+%d^kR6~J+A(`B8Z0NOqpdq1m$N8RPn&mi zbr(w$p9Gx*;_J%WXJWc*$r=vpbrTJmSf&;^%Bdkpzt^f_ML1-FKU40< z-1-^vaBExr775le-T%S;n_%>kaW@|H6@%Z|@T2dW;-QTPP>0PZF+S@ds>QJCh(R-b zE$BZJwS20?_ur*rb=ycq)u$pv0duSgJvy4;b7bt4t%2KAw4fe+zlJbl{l)1FLG0Pu z8%AB-El3jT1L%QOl{I4mr_dE)v(zDbJ{WYaIr4cVC88_mu{UZ22_i}P1+YEiV^d)JsH zia@+O+-SEt3jc@WiRp1v#&SEbgmD3(W?ct7P zddeYp!ds<>(q=Ic1d>}ScIvW~$uA@)Jduq&L?F+3LK`cULzL#@!?*f~z(*zb)N*l+ zB)Bj(Ic0M8bHlyTRX>IA+@%P9ro%`8+-UQ|X6ze-UJHDSf#DOgi>WblTU)945;TUh z-Ui3re>%?SBWCn^o674q@t_IYfGK^{#@oh_eFFT;?n1@NAwPw55NU(pRSHAsFtq3M zee?REt_YTL!}IShRjr8!4W{>AE@m41pqp8*30qf|_CL;#=AcNOi$bf5Z+n5- zugT6USn@WbixNn&8!kj2b<}&kx{oC(#iH@$Wm3CoC?)kI<9;A6Lk|Yic(DHRQ3fAV zE2nw(gSNYTI4e`+qMDAzOdym;-Ve$rWcy)Btp1+`ky}m#8cYs5X`Ca7Mh2j;JPGFC z+nhG~TsBO$CxQ&Q>R{C&xx_$~kHbaA;XpCKKEncK_7rXHbg>Ox!DlIY{sWenun4^9 z?5{Kd-bV(m49PKiG|O&H-w;{ASH94Ub3&a~K%$e9VIfj4!XNBx8Zp_5Sh|QV<+R-J zN7wDbn9F_%Tqw>iT&+Al+?1!RlwtsQ3J!9(x`ICd>W<5@Xhd zXn+sj3CBkdhtSVvvT%(chu1%OPN4OSwXX73p-c%>7U(n@8~b$Ah1B1llUVADG=g7Z zrA1W7cKgjA-ur?XeWs^`K0hmE{1Kr+KWGKbedv(pACvcs4^!mivx)MLbx9X@goL~P zkw)5(bTwrt!#E7((Q%*=hS2$+u8|UH7Hog4BlADuLBaZzZ8SP4CR342c~{YV`}vQ3 zN}VcM43*hXiJ9C??H|@}e^n@Q%W|Y|xy%eB69%>?JBD8P&Q?Q5?hRSM6IAEg^-i~1 zhcr2g9f6c?F{(qs0e&3r%ShEZH$-djwbaXVI6b7PN8w^&T3dYGLQ=Q6$fm3zQ)({J zxv5Nf;|CFsW|v0SXNK2V4cK^smi5-+7W0-YsU0WkCD`T;?a?bell{F&l12pZ&PTz& znywNoZ+brbygYbcO};@wBxoCxBZ2 z^nGoU`|VH%dZ@t^o#rod!pkoXUkS}l)gh4cmHItln%HX-y zQi!e%@`A*3tqD$Q1^YgG#+w8kW)7oaJz{ZRoCn&sJ3cJ~Qzlqi`9{QQ^z`1Wn-Sr~ z`^HlaW*~>rItKOXa?e^~%{mr;gBHYfi`w5=LoQ0Rx0IeE%}z3`^RIp)T+I{_h;zT* zU2oZ{j%ZO@5DZc%};O0R;}DJXL|g2 z2KBXq3h{m$_ILoSnsbW@Ph8I8&NizO4a-Ds88}*n|Q92)&1;hpm^)!;X)C{J*B6suh9IV5DJM;>~CK8kQ>ueZdL2iO`E8G z1>3CgJLJNL468#Wo(LHC#n1@u$^JWZr(g3Kt^Rm~7*8m7Q?-K%%_}i|#nkguoJ!l8 zTn%LVHQl3A=OP)xKM7hIlWlhkqkjImB=Qu{7%0*zPFlE`EGhPAX~U+>8roiU7sO+^s<)JF%Kw|mDW)bQm%n3&HC(_H=-^D39jkzE}_ zZmD*7o>vQGbIh%3C8|ZvOMNIpL>w)$9zG!Qm)pN)6@O_NRF~}Xn?Tn83t~~B1zfD? z1@_L8!|#kD63$Wuwb*CAZ8}C2v9U?3l}6-w1qGAAdz6fx4{uYw(Lb|^FlE0HmUvlP zyZy=Gh>mX7v2)%t{I2wziJMsiZWZ?J?Xw4ZWfKKlooX}m?mB7Y@O_O%^I}jg_g#T) z6cX6}YOr$h7-}+TcU`H2i%iv>xP77b2$oa_6TB-tgnKy0#lmQznAAwvszXaCm{28k zccPB;a7Dm^Cz@W4kFFt&YM+%!qS6y;{ah%#%;|I0!?1G{sF^A>Yi1^0$4FXuLR*$b zRr3MAQPHYo*y<~l(Q-A*8#TdVqh@hqpG7L|0<~dxhWzZ@=e(WZ{J*;<0Rv9v(`Gro zwqF*0NGg{4qqT@`_DSZW@ee>O_1b@r^glMB%0l1QrN&s(0+B@PCEK?$L+-HwZ5AnF zntl$eJ?q6ExN_-J(v6QdiXRM67wyC1bA#NcNNA9zLM&LN66hv5y>4Bd^r{W%Y3vGX z83yD_u+H+n$oxSh?}6h!(M5whPU|=P^(N0DzrsqiL}`7%D^H2>erK>$&eK}auy^x{ zItd7R&a`T>sw+a`tV{eko&Vv|b=9@eA^_z_&On=KUhckobEW zQ;S8)Xp}47V)v&Ph`;N87EvDgI*QmqJnm5A&Tb{aMZ2$3XCDkCC&~}%8FiXe$An)^ z?Vp^y0*%sBnuOm4>(jd?Ma$j8=mF_Szi5c}%%G@zZ)WHh>w9n(`RR%gYTi}Dy9FiNYKba{VZ7bSf5#UfgB=4?2 zt?Gu5hG~^xPC?qx$d&BquOWA^;)Gme#HA}Ksjtl;KRpFX;P4vK28LuNdCFT;W)X^2 z(7?29|Ct+FeMsC#xf>--uE@AXJ->>PX!3V-rIV_}%r6gQ0-x|X1j{0jMZF|LqZM?x zFCV&=4ThJS;)s>v&JE26hlUKF8xGK`O1gjnt?Fc?T z-RGbihPvWVn?ggS_j1kqBNG}WCg!fkD>!yKX%hR&r}gH}25kaA3uJZ}DaW_5O3L9- zj?4U74Q86=6l3jmQ<^{ZW`%fzk9MI~J1;P%6GQqR^UHF*xHkwbP0FC+3g%aWR}lqL z`T*yd;B_!NiNKpXMRYuGHS;C8MX}QG-}l5l@_S2T4eQ<$Qh-M@(W4@CHL5hC9Qx z-#Z^^fMpeb8WQeIpkuTt0XsQFWY4o`mh~7x3iB;zAxQk1HuElS`nJ01dc3m9 zj`>Be&64yD_-mKcp7MxRC29u)F=vm1DCnD4NI1`+{||xum=l$&Mo+;K`D5x2VB0@r z4>UT`Z9-r9uzAH+Oz!<8xY5Avs*FQ&SSgewV6(8eO=65N38to+d@^-*16zZS@Cg*8 z#=7}*jxBlpn<_*h!&`bnmk*5L9odB25k-W|&fSkRJI% zk(NZg^%VX${dy$IFjN|i_VM?w}N;k#BqTbBfoSV0)KedIhu30`k(7m|Hv=G$?+^Nv!V(V03uW$eu1s#sZ`FN0+^ z+(R~38)g%2?%^Ff^~q?{SxV5~$%2x2cIR+({T}41b?=awAfo3}U|)Lz_GS@hvQF*S z^Y;E-;Szm8 zr+|3L&Nkhsx$oy=3G#%Up`fD%yWWFMz361H0JW3O&~KRpezp_s7$;!!H(US>+Wd?%du8^O2|rvIl_g|Bc<_P{pGlWVs%>V!Ot3%d4$oF1#C ze?ed?O%`?E&KwWI>Z>zs_|(vz!C@u%Z8^HYu-Um@Qf`T~Lv_~O$GuxtYU}1GbWQhJkV3sG=vfeO{`5 zWIX1txUPeeD{I@>CQR7$YfRM6Z{sCDX?(^+tW1@kh6EngEwx~tFc*173W+36knLvj zFOuEk?AvymLQ06yNPI--9bJOMVf?(+Ws%dgYur2 z;c&zU?O*M&odK91Ut#b8=Xa7b!H9|+Rh_lTI8`H2g+1H^*)DFRfw&c?;DuC`-rw^@?dgyol}7QaNIL!Y@cO_T*xDY%c&zp0pmefg^e1U0QAZs!c(0$0 zuRhp-mc@Ag=5GrLOW9qXFv8zhvv>Pe6>~-#dD(3TE@V$Hdcji*s10Zp?+`mKwXR;` z7uv`TC0~9gLwk?8NC_dxG-y@JeHnB$_lBfI>X;T!N;a{Z*ICH@5CRHM?`x(BTf=0n zywA97?KTA&NNp{4@b7sje=6s!n^~}gHjtcx9{yvegT&_#UNU{{#Lir0nPr@|-m&;d zhJPE+kQ5TZhy}7no}MFgWDGorsv67*Vv1V@nHvtRd@zn*$;7xC>=l*XAT>68Q3;tn z**v~CJJB|ESpE+&Mpa6X9{%NSiOYR&EKcx)<~)HrZg#)2;p<*Z+p!N$^Sv9>1shCX z%~TDYmdo%a93!K{UbM2Iqm2InVqru-G|{XblK@kA6(ZVT5xAUXA-6cSzPtRn_>&85 z4@^64*NaH#68fn#mVpu(y5}|$Vx8#;)Zm63Q2t);5aIW^G(fl3M!HoF$MEVK>v`xv z{T#DdX7rek2XZ|_C^74}pRx03dnqZ zW-0~u+*+y%F?Te)hHN)>DOFkFsn+U{wRNDWEPBEtW)&5Y%g_y5n`-<{nFLvE``WH? zC+i{AaEuf6mLTZsj~4z{X=*O!HYkX$doVOR0TyVbc&u&5u+VP_2aPI4w}{K(n|}?G zPT!V^#Yo#?<=>iikadAbPjgiB-w{_S>ke3b7RM zt@XCV%*M&B%L*8Be+VVvqGY+~NwDIo59`oVmaVviWfuH1A?*Ms506xoRbZ7tHJkl_aw+hn!s zDVJNYb?qye{dx!TIT;a$i>VNAEV->edr@tH?J_R$!#N`qR<=m8RhsT>oUO);8q#@M zP1w?ncHu&yQ(XQM#J9@U_mVz%=cP}Zr@d^K+@!EvU@WF{>I);ck;;Cp8PaR%uG1F; zupeq--CU`j(`_!k6rOr;zBv#-GcKa%ahr6=lnGkpjZWN?KC)ss(Tq2>Z)?=v6?ld& z?_jxEw&F|Ddzfd;?<`grKLXohSG(-z<`s+wIgh>y0oG+1sse*kS^jazs&g}0^t#>^ zUtiR!htu$}p!x)9EUFh*zhzQ9wI4c`2o1dVsIzXp)g|A!E4+?Pit8JpnaYf za*I+bo7SISf&opwIB0`h$A#dAWYGu1VXw)Ck@WI+HmJi{HOc}va{kK8-i@QN@74ZB zPBO+c^;ZaaIISL&rpZ%9UbdG)ls9?0t6qgYQn4v;=n#;Rd#-)(ahZhu9c5&y+=*Vg zNZ#FVE;FZ?Oa@S15E{Ry3C(EZr;dMym=uTAM_TsToEwNgc20)ArPkNHesbu~W4;Uf zQ?3vid8kP(!loV>7efRwE(+sc42TqttN*D<&2u`c8A8GhZJ25?ckBEd6eRVBZ zSXkH(fFpNXrUyJNI(p@?VBaoI(wSVGwp*Kr_e2o3XQJH1PhnR1$K|@`3&9V4B0*t& zZ`QISpEG@1&`uJ6JUUIjt2YeeIS!5U_+EYNS15%fRH3uNC0_AOIY7c40ZqJDK4^U! zje%2<94os(@l)}9?yEM7$cIwVVFp*`${&wk*Tp!-D^zSse#|Np5WTrKB?-Bs1KgW$ zWHInoE#}i7kJ^toZ5mN0(Jqe;L+$(t#oqS3QTOkNd1F z?>>>RAX^*s%t~hzC5mprnIPiX=+O-HJh%oDhbt8pxpld&{&13F@prdVA5ovY$$EvLnux8bh|b6GQIKb(P=Zd&mbES?>MlRE+Gb=;h=6QLc zE?mHBFXe`&YiAr#uz#zeV;yII!Xx_gx~04wf&cY(DP<`1A%Y6Th81evzJ@oqKw2o< zBN|2wnAv?aEi>n6KxDHh@a0s5!v~-00Ip}l6)GrqGLEC!B+BBs63x}GMIJY{^1Yjm zS6s~!EzD#5n8kn{^y%eHtWYwZ_G++9$Z}r^l)bkhQkc<|Qu|F!b0k;WTK{xt$*q&4 zT*szwfzycp)ihWHEZPIyHZvUWgk^g7ZsD4u40VgY z0wBLRhh{H*OgRYj7*G@nX0j(zX&tCN8Z`&z^T^@P)SZ@o9vJPz$KC1ngmb_&D zUWnB1*TRS?Z~M$rqZq}d>;mocrJY6* z+{Kc;H-#qdOTZYL`a>n4!PA>JL$~P5Dx$~gg?C);rp^grX^4BS9We3s96?a~SqYl) zQjJNrFd0(3S{TnOX24<|kB3Oba&a8k;T6D*Py1^dZRsBUaxP;&Azo+;q2VYzxTWu`s`r}zk6NWNbQ`QtLGb(3*Ne;-)n>68=l%P^5BGm# zvl_J&F9Lm4kAFoj^ynIV2%!FK))tS8C}h-prbKw4_aZvC#Fy^Gzg5)=^RqPwlY3XCwZN{CCfo-R?IFlMNOJ+0(s8ZUmdBn31 z#t?e7jH`MWHulu>x2OoN+D4U4ISoa5awzgf!h=krx_4{TlQmk#9?y`-OOEf%cS~n9 zLD>gw^CGu(I+ttT6}TrP5zm+46Jk^)01(o86{*jutu%y~H6e@?E+!BhkNHY<;#8fu zFUjaj99z>oicA=a`<4+O@K$Kjh8n0zox(yPA9GVLdczUeP2 zbQ%xTB`KA52$u<1^CN~Avf$et$x`wr?LQXi@gY(__%<>y^+u_$+m_NKNkm%Alb;C( zavm}aLfw@S%nwQ^{F;ezl>6R^j{{T7Wk0A&UYkCtyA|grpG1YT#A0V=BKOs0QY)W$ z;g{bh?MeOeLBw8uZ6#yjEJt2i0&q$S!8qiEa8+Ts2`c5%@!X@kgUjd_H|-IcHA1Ks z>0_H8BGE4;KYI!*n~%lC+AGhH?i3@pQ4yk{WoKUt2q!U({`K}f$D};|K9a-AS46of zk@Efn>L;>t6fDYmJL2*E3H=BbtA@TItue-DQgQ)j1d@;DU#4tJPJ8_T&+iyy>4I$O| zk?vk!%UpUYCp;}J-!2MJd(_%)b!d+~XM2*Ciy=+t$S@MQdBuyM^PM5}i+p!)!HRk? zpGMg13Mx0J5O&!M#shPw-c;nm55ZQc&pYZnfkj*Lvfnm6y@?ykN-$dkAt&|*s0F^!J3;qQRc z(j7I+)R9u4q-0Ua-1pJ4Z2c@Y3qR7x)r9`7t!)&nQFFQDAwKL>9b(afIJF3tI7i-5R5)zjKX<5Q6km~HSOe%ia~b!cBDMLLIX z(LU)4&q~s~i5EB?Qj+>~D#9f3-#acMl@y zixFFHblc9{fY&fz5(B;X%=m98eXB|*6oZoPjwb7|ys}1P4za#s^OuZ=O<-=@3K}_1 z57xRsd|3jW9HXprj2|M*Z>;Git z{nQrs!`_KlS%BybDT~+!jRdx)1o%DeYCB?{4wVk)eVVMlv7cBAl zD{rt|_y^xxoXn;MuOGHBrQlUO+7GR<5jgqnFt{4n^d+sU7~LK6`vX{ro);fNFM<~q z$EMyg&H{_LUzQD*s7&i*(T^Whwhxa`E+Q|)CucGK7(<<0t9FC87sjcZ7Pwp!G6Inz zoFOL-IF9N%`Kj(4ZK9W%hdZOxQA7pwVJo)8xx`L^W^#63_no{JM}~0 z^$(Sw!?Z!&5(j0f;+ciRGq&5`Z4cSH?ml;88n}HH@mM7rOLURtA^+x|A@ay~eY8M{ zJVO|;&^(-0McQPelxERTq+9j)R@f7J=7deYvM2e#+NKaRXt)sm(Q>UFUN_Y{W4=PE zMA53rCYj2IH$Qx7CO48viD)n9y9@&pi>BSyYuELUlwM^$t^)bYH(L&m`Xc_sMj)|_ z>v6@{%tjnIktN5guf(;inW1H$B8+Y)Qs2If{%q*kq$$wd`^L6ZJ0em}$Z@>;jdjXM z@0n}vOo10k&YA})Qygi#tm>CE{Hz4h*nhR;n?I~6B8tT9vEDLa{Nm5Ym-ow+21Nbp*eDnc0C zMWM>>+yAvtv0uL`bi>f>nXyo{(vXKlvD1nD{xma4a#f*NEjyfJr2UFFhJ+C{J?JU< zxQ&3EeetkJ*`}~j1@x5|e19+JPxv-C@E)vb%BqR!X0!Bp$l0y_;!qNX-+{zhM%9~- zwrH|4&uFRoWq4l++eUCJLF#_Z>g1$=gUqmz5iDF`7#kBFf1umwq&;b_S%d#Sms$6t z#+NMCpc}tRqk6D<8BdX|PS-Z_olB{{W~)8xO6v2a!SILI4-PnqXuN1evD)~oIyk9g z>EYSfXeyP#mIgzVD)g+wI}8CVxh({HI?aK_vyp9{@MJZ;!6*EK%zA&ieC(?8@0r;i zhTip`Go+pWLOF;X`olJCVhfdx^ETrG6=-=gXKEB$$SNWAxUmLtp87y^7153J*7{1e zLqJE?#GW;HgxUW!DkW613iZ2R(T09|NMtwAAKX|D!M5WymCYsneK>p}&`4sVAX)#w zN0V&fq2I_oNvT_YgV@xq*#=nna@u3BhboJ|OmRoHJ7FuCbrgSB@;FSMH?ii_ zRw~d|Nl~~Xc1g1zY@f5(R%}Cg4K7|1mqN_hLJHQeQi0v z8B&(ON`Lwg=H!OH;Qu)UwqknT*ftX5)bR~W^}(4-bY{p+RW!Lf{`p!rdL`)Qbte28 zTu70hHu=N?@Lf2OiqX2Ax{7fU z0b#G4z~q~6ERlpyF;U@ph@Es|asDQBH0dGV(ZL3Eh*Ps1oRM=^TwAamY^Uj9r}%Vf zg+qGv9Jawgy>BsdF++-;98)9^uK*B7MzyVo*2UDXs2%e@eyS;JRD$QE6%4UYz-2#@#{>IvyZZ}?v-pcdtzJjCh~Hx* zk6#lYq3w;QO9#C{@=@85~A$R+?=hfU5g# zATxJ12!-)oxQO&%Hd)OfJwM(^Kp{gQ(^1@ZX6o}}IRLx8%lx~lAm@`0FOynjXpv-$ z@kXbY=k;L{c+!%)e|#J*nO;HaXtq?T=nD#Gn`WaqhPZ^pkpJ6<4NVq8Xq$k?S&k=5 zEQJsu(1+s-U>+OvZbTzsqJ04x-bCZjNEzPzT`>N1<;ySr!hHYz16J>JjsQ*he}J73 z;MooVMzuYB@eM4Xc7Me4(?zbJoA_e2)=W=80J*5Yt}pk4pvU z`xBYh#L2$Np7MNHQj2v42|X{5a_C=}G-_G)-OIlwBbfmup9x`r56*BXnt>olN z_V{eN#GYXF5TZl+t8Q~?;6u0D6Ma7SbazfPeE`_4u&1GQE?d2D z&`!Yciin6fS`pfb!PFq$EditLFd4?=cGw{Iy4=MH*-ywVt^o`hPM3zFM?2reyOCg{ zSXgYZ=jWm95kxdXL!cds`A!VK>Ty9ceMChjucpT_|X2&!0-+*h}Y+gn1a<}2Nc z=?AXmsazqYI{i=Waht}hWEiP7J_eT#kPLFs!neAJndT31&GCMO}uv;|cI<_AMy zfH{*nUhRM9JUIU@*|tHzE}i#5ju1E<#ZT~c2eO2aS2YQ5{^E176_k;53Cg#&Zq|kh zr|~)Hn~o&HRVbH=1IDvIZB8Z(o{00ijrWzJxuOe~=$w3=D2#y54dI&Q4BZkJm?gyyD&RE(cQtA!z>FJq^bJcd?DBhR zx$pmg)#(+-3@hc)XBnEBlBa}tQ9Xt60%2D^QQhBLi3r(0o@`P7g#s~nPL~6T zi#q|&J*?fQ(gJI&(bnJt^zI``?w3o5PX$y(@H8_G{1}Oe3Jp?N~iD zG&HjP1Qy~rp2j+Gd%8L_L7~se5U}zn!sB^?{$cEb8b2}l{P$B{Bw)GqCEIAGdMFKkMmcoJWOL zSio9D0PW#0RRI2~*9@+{)_-;CDFL7s--pYeO2y&#*EfK1&sY@j8V^;fRdF~$zJQ+X zE+9-P5-)yFw$0TH__9A$@t^+3jy>+R+OR@NNy+behz(f&Xj`tZ%=Si-B&y}pHJH6` zPqaYZdM~9q`mOv}Q(l;Yb*C|8ytWzlLsP9{Z~{g_mruyMsHLRxwY84!?t}sEE4$<8 zmxgQjPYC{fI4ler1AU`7)_WbP>uL;O$4ggTFt?s=iMbDjUuW>Y%W*icgWp{5@Q5*( z-wj763ASJVMJ+6>Ya2kIpO+Kx6dZt{_B-C^JM6|M0qIciT!we z64VWkRA_KcnbE$(^uLy3FJ^};f))8(!6*aw{jzVF!N8r1nsf+Rg7n8U0*iL!=|3mu zYd7Yr|9@&+pEW?8Wln13*s58(ozY8JokY;}CwM}XWjH3U6XT`9qMwgBI5;>jjz*`&c6zL! zCz_ZD;O?*cyuN2f{cxhUp2%xwZOW`j_AFG^SIN4xZRs6q@Cz2YKj|-C&N)tP>D8Nq zov33N8y!A1g@Q>+mIkYXC*^Sn((aOiw2J6C3HQGB5%L*)I+I8jo1=~t6X@t=Xu23l zqy%IP2~-REl5feFBwXe}5p-`Sb#5fv#D|0Jq=nZ62zyvIL-s;Cj8`C~hZ`V7Qg;9$ zPfGdI#tC+ApxEf-;(EeEk)$nzI)*~MiT^^-pRhdy)vQ@mz&*Kw;$8{}0Np9Rk1{J3 z{CBxO$;^9|18rSC_nJw&I+%_zaN9TV+E=gDWmHcZxj9)@fju!{Vq#uzx1W=5PXGVi zE*@L!aOEo+LIh3>RI6Gs=sWoaBuIh^c`moCB2IrgI}_jTk;F-ULNio4FKbh`rb8+< z2-!I1+Md|={+ZQ+<1gfa^UIBb1L7_K``Cp+soNgoBYj|8+)dY_a2Ci~ti5IM)RM8< zL2eBBj-nFgA`35-QWtfNmr!7V<1SqRg49X58J;%d;*pv5_WtEjGMpm4cm0W37yhx{ z+R=?Xa}DRpE*Dh40^dXtfGmVHIgs{3;3P0?`OVrOl=W`4$LYEI9*wNies(GMZGV6N zAlBkVYwKvo&T)c<(9mXZ0D*(Uxdr{oUEgu8-BNAt+U@QAaKt^4*l5SLLEU%;XK|a} z=<0H-L%!x|meiFqw6E2SD^syrlT)=)^{af4rn@^3he6s;O!jt%hK33?>hvK`pLb8c z<%>{+AYuGi9eLV1*jd`syxQ`5fjt<1tmE8+?hG4WRb5!)V3G5`^Vf{up+eIJ8Ha&8 zjRugQSuYpc5}f5QHNFC1sVA~=q0V0fLO`Wf`}Mm@<`)&RPZr0(#F94B^)vC6uZePw zO#A}HwkrwoiPv4aZftVKEuF}^gm(+tC#vXE_(|O@eqigy%F)}!Z+>iz{8h*a;njTv z)n$5|*kBkD8jRUe5b|@*o#$3pE39y#vT!EW?q`Nn;7pdI$D{G*+F+&aKyY$T@x!J) z_+uTZb!%SmC+UNo=?2kvC`!ZzS8)Ctg<`M!AGZ7)scXH^e}e=j zad2oBXdW4XXXywyP78rx`2cva&8FKHs9Y*LYR3++67oEYM{MLq6R8Jmj^7>#toj0T z^&Z~p!9*sFKaL<=07*)^SVCN!B(UfW7O{+Ov-@8b+s^@I@AQSWEh!0u?N76d9vPFo(wi@eMLbI!i0RGw zYJ!tf!82yo7;&V?>Fj{LcE6`vXR<^9 z$e;`KAJyXMcHHhi2zFxQ=2nG`kJlW#vV8VN%o~^QcIii+2W;rXM(*DtR&M;ibZM(? z8^?WV68uD}F&1qWvqZzyk2StXF5N|UQ`j)rZwc|pT0gxR+YSIQpP44HP75^7$m^c`b)#Vz4%l@Y#dsanaE2;m3)c%Xb#-cR@srJ#ZPf4;$u25bAPcm8 z*OS<=C!;!9jqUPh!Cl_d*A(-YUE}shKV1FKe$EzOwVZK%G%bQYM?gvH@u*=%+SKnb zH-V%bpV;#tu3%6GM{DUW^KYEdz)=Btgs(S%PFaaZ2 zo&FcjTjW%{evjA2S3rl>nN|k_(1Rqfmn8;3RiKA6G@OU~=N7c|g`$^Mev^{wzbE$0 zMh@x&J1093cggEw*822A?tx071}{z={pW-qxlM>wC{Wu@)MiX~Yd9zp+6f>J%r+XX zmSI=1%wJZ@BQQ@?zYgFD8J1Qet79<6wYBZ;M`-9B{?|wRTFoC*9D|9sGA|v?7Eo-_ z-lQlnWGFKeJ<@(bhm<~BzsD7M)%&z~cw$tp1Tq(!sNf3-H_Ryxgv|lRss!9a$BqH& zE*1TQB5cODKgMdU*=8wE?dX;hh+nYs^75R?yzo#*MB}C6NP#9|cFwC;_h^%y45&*0 ze}hHum#Xc4AOAFg!rQU-p4S&L;H31`yy2LN`^U%V0}he3V-f7#ogImT_UWx-Hi>RT zS3S{AKQLzyZlAfCm^X{Di3v76a(}0%TxZZG$x1=OPG1|C9xZwY8;>l8 zn3u9jfG{gojkCZ@DPzz-c_2J0K~A|v7cPd8ygk4&#yd>dkUQHba;ab=(1;<8i_$1b zX?j2CBiRk)+Sp`AMCTusGaqew^oiKBOjbGn@4yGDAISz17j?emVkY}6>p!iWv`|}VOWW~v**lb|3)SCBQ zu5M7*|F^ys8lJ07-8_X_)jOV11@>GiDiAU(%*e*Rq$o^?!M-%#8%s^j*8gpzmI^7@8I*@=sDzipf_Q>5?70QS} z4~BK zfBd8lPaYM5j1?`g4P(x=n99L%`Ge>D z%d7S=5DxxNu{0Lw+0Fm?MgzE{yMO6i@>1#!Kz+UR+wQx`zQ}Q=>}<7OKn3#sfLlgC zeRW~AN>yVJUi?ybe@yemeR5|V}=*}EO z0jUk`R{j9HVnN{Atv4`Oq-(UB2P@IN^cFiu(56uwR$FR_Ll4GM(RyH)eyr&j;qJ1*X=o`JZZ4D}HFkCoD1h!0w$qJv~SC{-KHt7b?}9=T^5D zh%f6FFQ@meavWb$C#y8-x-Xe?My+N`qBJpc6D{zC-<4b2jPeB%NpA~m1EL5)Pu}mI zF|X@GCD-Fc3<2le#HW7{5?m;$(ni_g*l@q->a-}+ml2l|a_8ug(Ex+76viQic_4OC zggtHoWRQA~bA8T(_q4RT?Q1UL-D*xwPQcgRwS#7ww4+li7 zez_C|>TcSBafI;jaLC5Bjdv+Cyxb~O2p_$ zUbdquOh=B?27E7!=YTE|sSxeyW(|{4E1w$$uD-6nr)+dQI6$_OT(Acd=Mr~FXF}1!&0$@@9HDGNH`5V5+|V>H%EB;c6?pKMX33&!qYm(CP4xf9#1(D2P7O z`r`ukV#fI43edEo+E1WR==4S{khKqqnm2etjmZUFWqjLX&pV{!$@>5~g2U~vs#DJa z)tBvj1P@o&ln8HsD} zGESu89CYG|lTh2@A{Ht%_RW+1{o55ZfH8ay2u?%fx|dc6h=@kOf&fVfSOMFb3q9&= ziHV46xu6)>`w+q8>;R1p2r*Y7L9}%x(kW6(iglvh+#6j-(-?P(mi{2pC_&a^W2H2J|ZmS2E}4di~REwDFmar_cb zAvB0ib!i5*8;hZX{?8`d883qa5)-Fc9cCkz<6EWs0p&bD0RO}G@03Ib0(QudjXW^n{YE}N2cA0|2UkX7dWXUB zL}?QIHoT(V^b3U{eLM1Sj~K+**0JW;lc|CPro`WfbHSC+xX?@5&-64+^+kwBgx{a#c{d)b7U+4J|K9I>M9~4B1X~x zH@fG7>!dRr5Wy&;dUm^0p0@hnq0g9??!Y_K`)p1~h1{#}DQAx_vbFRV&LVMWy2p%h zHaqG%M#j{E1r`}~AD_mKlJ;`#8W^Y14trPbmrx-3-W+zY^oo;) z!ESd)@j$-b;+by#1LHBnrc*guXW5-7Ku-qD*L(6;SCLm@?0|=lRs_YsWJ&}N1(c?_ z7Z|})CH$p;4g)Ysf#bZx>#9t%b7*c358&ApG&JSI0YnB~{bV%ueaQ_<;IkqC%_%CA z2avZJH0$44&;Nu27+mel588gG0=xO;D-wtSU$2j`&K`z>?8N|4Y<<5|@QXjB)G#Lz zOS+H$p$@XyvPFP!k)H2$(~cjTjCBWhlgNy3&HsykV082=Y}v}d$=R&0O_C~ptDN(n zuCg%$_tyhsihzlKWX{RmDX6h=-nLF{{F5(#>R5DQgct|Pm}#&xV$&_=pFcMt|Fo7+ zU)A%6QhCZ)G&+NCf7hu7q+@%hd*XU)kCWWM<;3o{FMI%WhMN5e&bw9ng(9g?7kt)@;C{rt&ug-j?2;v5F*8N7vu+&f}tUT zsrXxCC4#Wt@!~6L#L#fzpc%S)CkCVQLv#%yqBbZwu%%?FHhaRbpv@05lC;$W8vT;tBS8idB|`8P&nulo~|*0*9LS)q$U~yHm2yQ2B`H4^PPdA5-TT z9a+?^>yB;Pwr!{5q+?fXJL%ZAZQHhOJL%ZQ&3ACe**|Nnsy%D%r9JVygC?dDJWS78 zMRg$!4J5dS|2E9o_9r~pBa%M<2-7^xr1-@w;78L-XKM7|y6$K09UDQAY58$w1|q@0_XA*)sUlnk)uDU~@4!#p zDDO~lc6lQGC<6NXEwl)pWJ33yBm;IC8tQIpfXo)lVVbpJ{JO;Hwn@z{(KvfNn7Lcd zL!&Qw4q|#@dcTLEeqi3d#s%wu!NvirY+)x1i(0J8! zSb=OluS||#v>)rG><(>12DbtfduPYN6Q1mS@!SHqU=^Hr`~|8JVwKm+B$RjdP~l*#vM>Oky0l=QTn>7vVn9CC+t%YGJ0 zV0QS+u+aR0S{osT3tRzM-CH>Y3c92J%$T3Qto0h3!tGv{6sx6P=S5W<^)KoXsfn@L zk7k(wK{#XiQQtHNn=V6ja4xIEAW#){#67rEydN6_kDhBHd>H|FdJAj@!6$udPEX7QPQPoQjLoLnb#ib4i;^tOWO{Y?@$Rxj()###>kzQn#P zMyGz-O*jt1?Na|_=S8me{vYJWhPIya^ z{@NuMY&X}{V524!y%r69c7?1m=rK7$vKZIBgwh?Ywean zUrNlQ!?U9qHQWel`ilE71gn|?ps^S6>rn9~I)rWOYxTE5GxURoh8i!{mTCfPi;%~C@)gXYw^bqhiU z<5h6AIgW;KzZJUjO}Qw$~w0HR?2?YTHeO8dR-k+yBYisfiM4X28RZ7Z02zZREvx z2C{wQiadfl=hY4OnH~Gpz>x<4foGr#uzw((G*^k$Zu>60M-x)6cy(-wW{eNPw(QfRIo`|3{iRrARDs7B1w{@YWLhLhG9D~5JBXq)F z5;U`Aj<%qv7k**Z4kDNFAV=XQhJIDxWEFpW1BQHovx@V6Z@-_eRAG=`wL`MOEVCR} zgl`5-7TUUCudtj{@=ln>@W}DB&gJQP8K+p&HdYR@Z{dSmHxoo zJf3y@4t1KMLBJFyE<-!PPwJn)-3Ldc?(ccoBLn!X#Q7#WJHt{3M+OAg2enpZfnesB ztlpFaB*eUH^0b&X)LzK^}g3PvuM#+!N(YpZJ-1 zZQl2BQmj_eO2&w2Yvb-~)a^cKF;50>B^M$9_XCb+DDP71KW1}a?#9)iuX9iaj^0SJ!=BTt z#%D9y`g8Ww)p>c{hDL>ObW|Hd-ulz(#{%har4DXFlo|w{0 z{na28C5`8iFRB?z@cyderk_Ra%GPM9paNU{U+X;NtI~_BU3a{1=7ErVd_H9kBEmS_ zf9LQ7#xg`=#C?VTf3Pe=r>ZsC-!-P~(qDf=l-_Q!We)jApNXF6m+ABZ;Yz#?136g4 z-u70p7}_pb!dfE^POc{C^nQ4zB{zh`Z7FdA=r}gnobcb2xsP?Anr- z`z1WhAT|L6Gk7c%^>^@g7oq1ybaT~TbIH=6B}PaN2>${zs{ar7F8lBH_CkTTNdY?7 z*T6tCC);IcU2=@meFA-jhHS`K9x`X|M?2K&1u!5fmx8UoY!bI7C^xE>B!{HyuBn0Q zZI6I8zB(Keg2d)OjWZ^T=1f9XK58%!Ed%2)F-OhUnPkW?;!dI+^jovdQaV;QhAodo zBXf;YHyqj++d89u=4OxQa&4C&e7u41IwoT$U7`yeDMAfTTdR*%FlQW>(F@&k4k-wz z_Aq=I&mmq-(yA9--e$aJ>6^)B(k;d6f7xVgJhK=-G$|O`rv=Db8mw<0xHVU(g9Kb( z{?m1)`+}345B4lYfwefNYYvS4L+m)o4^~0965F5L=$^I=>8@{|3EQQAH$W+sIiV>t z$AUkwD)(#b$Z2pJfzKb#s1e3i&imE^7*8yMUL(*Azb1F`)&yXWxIcqdO~vlPP7e+Y zBu9syFYM3cbmSVO{ZKz2X3y6cq+~gOzcrPB+cfc-hT-Mp;0^DGKDF#gV!;ko zX>dG=If@9-KOI%AqPx9eDO|3Gk5T5sDE9Y(wB0O%EX!pm6FDkU$?J%-r*`gzTF}Ik z^%YN7SueAb8kn)Nb7l$~#!~LFwD!HQUhDrI5UExsBvPTi%Wd|hQ<3a3#5g>sr>#1l zVs_$_1>=KvU+I>T>{uiNGgTEdyc}tUUA{hk04LnSooi$R0INC|+s?p>h8b}1KQYV2 zS{wGCH@R}X%xo@uT&Rgk4(Qo-W6?ccjY5~@99>)AF~cC)?d;6kpvN%{H|&g=!J1=e zD?SSNdo~#UX9W11?ijI!W0Jinq$EuU2?(CLwYf2a!7o^Fl1eM=u!O|s zrrWk4z(_@_PgIyGd@}-R+R=AmkEiNL(L+F;)fll1)-sYQ2ZKbUH#jO?DvU)NLEqiq zr)gmN2;~tX(Sa#91{`fwGCLo&KV!4;}h;v%e8=epeAW3(4E$s|*k6q-()dY+`ayxHQZ1R%0h> zVj>ZRwriSLYRKPW0gK)9cQk|;D^ZmsM$+9|CSJF9EI%n>$5cOaK707g>~ob1)X%>3|&nt_X-=~V`m z9=+cFhP+kew|iW^v`84X_2hH=xW${g7Z)n|c1GB2p@|1Jm|UvEj3@>trS$K|%@qKs-y|11?ZA!c~-~l+_(19~(k~ytv|lax&XE z*U_dy2tfZIq;SK2GMQ1kuSQ$}-+96EsN4wD_^7?eh2b2E;&djHv|q_8YUZ zUOCfXD~SnRdh}YuaNhUslK%T?CT(TfEW*IZOn>l#twzx(qLUN&TXb5mJqmB_Atl?} zIq_V_hFP9Nb-1tu4WQE$qPe2ZAQl3+tn22kS1A&UABe?NE@Wg>Lm)aB5ufzo-JsJM zjJ|6sABd{;iY~-mB&$r=;0&a1C`p9LZJxH(9lkF}ZS2DQUkyUP^{J#xRyVHgJ`Ev5 zji3lko#hv1WVZN3+X!N(6q>mn(nq?mRXPi1!|~+E;MhRjnIR_JkwJo%E$?rX;adS# zi2E9ff#)N(LsT(?uS6+MuLTU|@Od|H8!(gk`tuEE;(U#*(Z1Iskv+M4cHiU6JDfer zgGk-WI+J&kNP-TOFtRZ>fdvQvKylcg%$WT)GSK0QZ(SFH;tenCxIEK#0L~ zpW4N%qCCPt!?)yQIv+~FJ1i*6+`;)L*{m`F!x`a69asG)vI*~Vu;PbKARD~CV$sOt zlBKAUc=Wg&b#nAszz^%ZzitQBs|XC)!vbBL;K}$vG!xrT6(zdi>h84SCY9ESL%7t> zX3Z4(LD;4*XZ)|uDqdo`e6PMT8R9xO+OXH)2fb#{r0oTgkzK5@Y($2}@o9wOHnULk9H&j~eIUJN? z`QQcLf0D(-$FA434g&%PcZpS;ZWaU%Wr4QYyg(7lJ8uSu8SGi7{LcLI4B5sKZ2>dc zzK?-LjDIj{!4>`-inzHkx?=|E9yAyDTjQMDMVFrjqUYCH z3x_&bCTa|X8S2Nh(&Ix1Z1OPzu9ew6GzR(HeiC=qSS0dSUUU`*^Y9{{-)D_aohnO= z-D0t=nDz+bRENc0wsbHB%&CtVvf)@Xq-a|QDC@i`v)F+TisePF`2mQ%)P7!-Sp2{& zCR6=xF+!={4{UIjy@AIb>P{5tVK)>-so0)KjLmg2U165B9Ie{VxrE*i4gjZt|qGSOW^ z!wVQKB@rUC84=!X!0J4mS&OO}fhmC3V<3e@R;nkWhT@3pu9b2 zg6t++u-{K${oh;7)w?6&G|F-?50PW@#wskCv$UjAJ>kW?#b_Ng9><4*9+h{w+`+-y z+YU4t7m!i=3KGEBt+#xsP=W!yr=K#SnfRCCAbr9C-1mK&4_bHdegrmz5h+1`7RU_; zfEYmecl@N3O_bWQfLHc@$Nhe+?99X^bs)Ce-vy7v+zkdB@m^)cbS5UE68Szk*j%T= z96vPh<*5$&a9YQtW2$mVT~>xFu@zJJ%Qd}2-&bE&ec=QaJfby{``oI5$vzL_X)9W9 z5CoLMG`fJ2P(nBSnX9ciJn8HI%XCG~q~=Jx#`&P(bm^X>b+xCK!DLd`_a95J!5uvV z`@^c88ZH6~_F|c0O*Uh2zpfrO^NLA6UxjlG_b(!t!S`@;R4r^yc;w&J%pA> zA%b;y1iU@J&z8W2v1K^t!TqWYMxRM;(c|L%EP{j+FWM}Q09{Xdas(IuWOIVTxp$g7 ze*dq668*D6Ma-@1pz%rKLkXMQv@FtL-kDyH5{%+FCLY_8yGaz)dY9De$X%k{UH93X&%X zD3FM2I-c3>~4`NCsjI9>HquxG7AiaSx!7_JH2JdM6{XKJRr<_fIyj z90Nr|mh33NqwY?AC3M7>-e@U};X!F{aLole>O>yZNLC8k6TWMtQD12a#T`>x0EzC> zhLrAz>)*B`6%;Q=1Z^vlY_#mDq-qy6d0k5JPbt!6e=Ao_Xr4VqyjFrdu9Fr@j<&%K zH3W+Tb9wA$#*yGKZUiFuu`UTa-bnZzbs)o=mWqNTGszVS*B=T^;y~IuYY7_)=$Nhz z-bgomcoNcUtU5+~@m4F!m`Sz;5)=mU`fiHfp7Bhk2a*p*=7j?{I#!rtK0*(07m`5E z@J!0&JUd49eXrNeC;{{^8ZC(UX{%CcmE8$KX9qS&pHC>Fdx0|b%M=Vf#j(>>tYai| zUG{eaQczQ(&T^#gPn@aQpBo21L2_giF|fO9rH`;i^D_C=5yP)p%oeRbO2#_ zt55=pTvK9AbkO70_x1Bvys2@-v6VuLWHM~;wi8b#vVKCJ1Y-e5_(q=rg7uRCOsGhA z*`s0szVRaWS&|arv(;7vjMn(8jGfq86hP?x;ei#VRJ#x@?FkdSp{bF?eqg_poNObJ zKDS&cT8#`ZioLFJG;9C&J(O z6bY>j2ca&{##WelGkt>wT+X6Mzr8)0>xuBsu#JXD_S`8(T!<&|i{g8?Yzj9vX{<2A_(j&6^dtk7 zUa}0<2|c~@rF323-CI3@vFdJtaIRWRG5@vPA)S+V{@R~6K(xl94(lprb&nr~Cek=9 zlzs|1jz9388uJi<$4T~ZMrXpY&oE(1RxexsaVuDbL6%DyXdrQMk4HXiV#w0Gk<8C; z1{E@nYsQLlV>grMlsQUa034`0{R1xutW^y%`YP*@Qm;1G5oX2I<^~dw>o69eE zN*AnPi*GJ>=?_Q-Fxcm>jKAz@3Xg}wNcpT&80Hp=q|R^4ZY*5_^`B(9*>l&Wy~J)? zk=7MHRz$*)8A)LLh^kCjF5~%_QPyRACmVHc$*emWubWF7Lo!*L3z~(+zGgLzYOl*N ztNd+~)J%mhk$>mG0dFE*h*rob7))toI-5RI2$ua^kB#uD8*GSTUZb#@Hp_&Jm!)AU zVfEu}JNg~i^wBf%69<>n&^XBYs#|q?0D7$h`8g>_Sy!=YQr_R*45%#{clK3VZ`3{K z3s6JH$0;jFd7kh>LTE17J1N=9Y}z5W;J*shw_|EFQqa@TMGbSj$15$;k=+jPpqiY4 z+=rhLC|rehlPA5zW=B0h@^d%0h)Z}>l_r`Ej;-cpp!20L2rU4RDG0~k?952Knrf=Z zqACwjH@_94nG)I?48qUSW0Mm^Dp!;-VbegI*&D&gUFQb*zBOeq4WnZ6z}zqp!{=a< ziB`|Kr493QXSe)@8wN1XJtFbzerc`L3^u6HQL;_bBlXGf&9UM`x<0_j9|d$sqdgz`r z6Bg8CjK23*iq>e9BiR+OEHoO#SRJUbWAW3KIyM~I*w{d)1Y6K6I!tK20NGVGB?75# z1_giYi>)pgo@W~gpecEUc3hJ-Erab^rqyP5Joui9fMC|#!Ug;QUfk7{_`gPmx;kQF zzY$iITB0l&UUImH##^0G`ix!B$dkBQ2^2!45-wL6lky63k?)aauOX`L)E8O3{9-O3 zaS4(m2D+OhMr>!L`0p@gk0si3rPKg z1|RIc{vGP^Rq19FCR9_ZU?IkQ`y@t}eoYNX%v!I^={ppt^B>=n{(o-GjR?$D7=2|; zxUCOm%Sm9wozuwpS%C{4?NNBXpw|d)_spQ)!|;Fs!U|vwV=)!dZXxwH(5tJR0K5(t zBGL|MCcVFzP1!FuxZ-el!5|dXB%Ce4j}LBLk+4b5aiCI?g6U@%;Nmfi3+|Y$xbV3v zNZgSjHK1@oN`u3oyD&50S1yyQytCdie+RoCLGsK`*PZ-o7tP|8lrH4vXpe+Wmy8*f zJ0JYBouGbzPX$-!Iv0h`jw1n*iN-^M6T=`LbEb^;TlAG%wJ1mRbgRld?y#bsd}zy` zrbG5uREJ_)Lf_juinoSrk#AOFRgJ_+5@3+j{6ymVF+lA7cP+J6WSRZsh`Gi*agj7; z!tq+ZhcW!2RmuHPeEp_)iYhUZfAu<}l1Cn>$gNb2;i7V6ItpeQDWQ2r9)}dtB8`Xt@I2Jv!q81>SrDN`TtnC)VhL|)5PeK7j zLcO71TgF?R$rHj#hVjsVxQyX^c^sSX{&)u^EW1r{u`O5Qe26t3F&}q7K(phO`IEH@ zP$lSp+|X4K_(PJhY*!p*-sx)6;{3GDHQ9B)+9EqS%7Za)X1d|`SjK7_JsxlM!vE~| zX{NZHzGj%)4VoRKCM2zc0fI}ns&De_Y_9o?eY?R1Mgb$fe<3W9_$DC2T(y4kd^H@s z#dF)#icB$Px5@YIA|p+Jk~TnTQsrHK_+FKIT<| zh=FfhV5{c1sHQStJ}WAd!Hho;OfRhPA<N*N;h5ha#8>Lp8 zZ(7vzz=u%3>3x4ME9_(=4sqW_<2bmGbo6n2FikmSUirg&VVHlp605R;=!mX&tZbBB zPpC93_HG!vdl{$43V{x{Yf&9!w3pma0{~}tI}d%KG%oh$KnD5gEmA4H+Xdp70TYhw z>=@Ea!q24ahXtad!aALBlplzFy#*R`m{1ColRY-Mg4!)pcw@N+JwAzt4oON#tD||v%EFt? zsCwWfXt0f)febHQIDEQ%C=$4HSLi>7+ws&)(5D ziX69Q!NMQMCLk#RPHK!(vNrGqx+~(ed!Sl>_!s7PUqWnnV!<0@8-m~b%_*OJlcu&S ztzPd$cB}~SOWVI4u$mHY`*g{>hAdT_7B*H7*7~&efa54#&Kw3tvNqX6MrUu9k~K)UHGsDGcaAOnf{eN^#CD09gHeXlzI)_2t| z^Y|+PLU*dAjN&8QaJ0N^J~%l7JbQG!Xc%Onctv^5s(K3?Kt9vkI#*EpPx_Zl)jzVx zf!?XUNOP7s;{%!tjUGsx;f;U+NYW}(<0fLM5_I%En3~~&tQm1W;<3?gK^6MQ%!M4- zsSKxtyFJxJLCrrw7FZ?}M>&w~fwPS20`91=96SBOEbE;K;1=4@vw%SvnKV{(z;KO( z5$)w>1}9M=A=*3ol<;}JrCkIAC|O$Lt(;{@BJV z#^SrLb!h4hj%W`_mSxoiF(KpF&l>qhxFnmEp73eBMx_i;~5;3pt%0aL?-(fZZ6q z3?J!-pwg^DNVK>3LbEk+FhWMab6sBTg2}Pq!be1WC1sU=c{=ggdD$M_ctb58z$j`N z1ABPcN)EbsMk}!IT~B{xT}+*;AG+y6+XK5sYC~-z39Jg+3W>?Jx1u6IM^6zyc)BlS z710U(>9SkoC{<(1rhnKwm9>;%eU=bDC(ag_49#67nS&nzDBP?@qos}ftaOsY0@ zLeKOU>ZLJnN>*Ob#0Gu8=fzMC!Lw1*9jt&>%aDl;75HjXtWFT!p`O{z^O{o{+h`TR zGL^b$qZ(z=Tsbpc3-r5#2T>SDo1bmzGOO|C@YuWX?`NQO34R?oR}S?l_FM?FOBN3i z`6|IbskLv$kVO-HTi!MgnBai7TAvah`c{`+NN(rrzPHy!H`HR0s6A|PbI1y35ojkvqB#%# zU4$N-*^jS!+>x}msRO6!-ek7Ja*252<0%#b~w9+j#PNu>4*_DeDn)FtgvQW)T!cvvvD5 zjF*V4IlU<9;rPrcjf3+mygLXa{k9@5O$~G>qXSXS?cs`St}X!^f6LuJvK3*~{tC-7 zP;doUb4vP#i3@>k({P>3kiQnyLgg4F&7quBf=)9$mBkVT5T+!a>j%@!@H_(Q1dVK_~Y&h4FlxGe(1{@=Lc1@MwUYQgRtIbEyATqr=zzW2q20PL)h<$8cR9#XPj3%~o?>bnPz1x@^=>o5w zx(6yAIjye`3q5tYSeE!wvY9C{OwSFgQ89*(B`ucQV^b;Gk?UUC{i&SiFdQ7N%AZ6L z>1}wHtcp7O8D-R@LBI&UfJ`bIa<+1C-^m4)5gNw+ZBvBgD5X$@O9Yb=31&_HT^WCz zh~k5#n;6TEUTCbMUqTWTv+}-TEK&e^aQOJ`#jXP=MoI&ohL!}z zkG{C5iyRi)!&xsHAI0!~Sv4hy47WkM2pIdNXS88@OO~gA!Q1BE?xKRu+~L3sc=?PV z-22blb{$U@%W@R6=-rCj;Yw5Q@axvi;XdD@T-9$-}2SkrbVvV@5Tj z)sQ+n=!RLz*XUn&v4|ZsCBLkD-r8p=RtJZ9d(#8O)u=24JT{>5iE;DqI+`~e^xgdc zNu!b1{g(rV3yFV|Bfe~lX2yA0`Q!D-r>*n@3PsOuC|Z;J=N~r`FABMlYa(#=W)qgE z$K;0JM=9U6+*&x66p}0RCmNdmrX$b9?b0tn>9sbHB#x!_YDf!arh1(=Uysxs|_TyJUG4QlUzoHV)_Gn6OGXG>qIpO2g{(>C@_kuy#WETJcVS% zL;`Hk9W`%t;4Jr4ipIOYy{0K8ULq18|2z*4CJSO!Z7gYHO=`CxLdn~DPYi^FjKq;3 z8xS={RaBdR7XozwwK{o$oK>P^>?*m!;zG!o;c3|&M zwf!EIgc>L&SutD6f3CKI6v4yarZ_Cful7Cjf3uAMVI;6hNlq@fo;0THXu#)ZwcVSE zAyLVPAXgMqS5^GHQYQ4S&X6S>R zF-b#LH{0dy+uo=O>6qrAv5{3>Q|aJVKu}c(o6J2eG$vZuO$NMuM!^4(B&dc!YYibN z$_u!f??zZfozZ9mR+K{vPg1HPKSIQl634lCSR6OI=Si$CnM8b5y}#Jg)ahygL#*2s zQJXYo>|jK=$C^hSt5is?h%NJSN`IjUM(LAa|Fguf@p=P_TDGw?vYZ{2CSsT0gZSZ( z*|o+BCi9~vCjU0vdbm=heNCU~WrFgka}6vY^GyPoym{um zQu}h*e;lj)#DtaLS`68~8V%%FMX#~R3xX{+PXe9P35BnWwT%HmO)PJz_x4A_%3f8r zeghCKg0i~s-W`oW&s`8VwzDI+t`L|SE`lT31qM`T0p~H>MDfWD`D^;EsS(Fb3Mv~e z!8RhSx^A!eoyMlHMMqW}TUhko?}X2vc!7zOfbrJ2S=$BpWN_;}Gwq*3l1{~8Yp4x) zYkl+UUwmlhlG0K_vOCCGIvxdTTJ+VMUcoh)s+`jI#ncS?dQ$5y4*t|#M8%m&jT`+^ zIWdjYVx@~G`}Ze|futC{c_}<5uuXkSzd4Z5kiu6jykQBpF`B8-T0c+OgoRlcZ6*vJ z7S)7hHR##K6KAVjJ)f$^ZKXUsxK&hCW;@*vNMrQCIe5T;3$ig+%Pw2Mw>GQs#%T)Y ziUObx*dvHk77*C-CLIu4$W>n^y~i%oXfIC?{Mn=iW9SCsvg zzvF7>t?$|c`mNk6D~%_M*HF#Pxt#3m{emk|S!K9;r~9Fm`LgWamvy{ekwL;#lTXJE zOWKHVCm&ZGGa+IGH3k8lx9~y9Bg|G0jloD$5~a^1UJnStkxQUf8OOjnAxMnX&m#dR zUzAn{emLhLLQ1_MiTUW-7qn)@iL(_A=-E5o(T!eQoSe{V0{Z%g;v0=97c$)`G$aJf z(wcS`^FTVA61l9A$9p=Iny?yvkND`bjMq?8m4v)^F#gR03QjH75l@ZN@c5U}@-enV zgp{ChYsjYpxfJO%th!S0pIf-MPhWVVg~`25dVke5Hu|=ULEf5E`l2%A^ZxN7*)*%x zx-F_Y1CoZsD4nN(uujF^AV)$~^YP?oqzU+#jPrXBkw~+Su{9 zG+~Q3^Q6_GXcJP=iRHMOvZ9iU{P_d&&)xtM<~`Di3M4XvLCM5K7bpsO1)s^7AXcy2@# z)dhF@2crcg*_6n8b=RzLcCfTrf$6jAjXO?Ix1(CFd*md5kD6ON=ue72Ob#aBPL|pDa1?c@K9iwa-OMCxE%WM>6{`Gf(@S-`_kVZ@$jLD ziWS5pogn_txBmJrl8cQdU+v${DsP&bB^97J`)PPNSNkmGdC}=C^!Q^Nx*ie3$e#w}(xLv?*@= z-~_Nqy!QUQ8XQD>1fMkE$Q(wjD%th^>CM!2Acu!-J;EMgG?(a0{q=5?$)>}=_NpW* z52s5Y1PL~F+gs!CRd+W5%{kAKv=A`~3NtF^nSkb_v$s>Ls>niOphih3Vg8W)`xTi~ z?#F=#Dev3;Ww`ZhFLBh%NjO|K$Sr45yZbAYz+kex?|KkS4><$!o(7O4FkWhEuxAMQ*f zCX+BKvH0Xp#`E=#h`fBvpIpPiP#}0b?m)8N$)R4~TrKQRV%0;Mt5k&tcUv*)o>#y! zK^1FXuS8>v^Uh-WHt5~1NP{0)ZSMEvo12^Jo)sv6U$_6S zhOaqyJXnXwi!a~aC*>@b6WAWE3EhtWq#U>^O zMrQKj$Sdkb<5}CX)~4ZsA02gHTTqeF1TE&8N?Mr((d%Ry{z=)5WquDJe%m<&+Vh#AtYLHZP>OUL<%+WrwRsWszXJv~` zTb*Za3WbFggNqYNzW&oWr7(~Rbuc?I4tq9F=7tw52xm!FDDjdn+zrNd)ni*Xg!$k_ z4}q%-67SD1vfRq2X*rtD_zDw$e@;k46Sbdcc2*tKhzcno*%wZ5fs82`F?5o^vu0LQs%>S z?PTc!X~D>WgQh|{y1t42hOzOiq${N&)!ZNiAN=`}iYVL;4ziOz|2u7e`q@V!kihwC zeb2xG6o#|3oKh^R5@^{*!+*IR*ba1Y-1O;J(LZK!9-_s~Pl^=8SvwbO7{1{X`@BNa zFgd#N-Ny@}yQE8lypqvr9^1f?vJm5(TlFp{de#ZxU9>nMYkMq2AV)kZ7rFMv#TbGl z<~99lWj!6ge18uod?qCD^>+1oLv$yyJA1b+Y%lslA#tPGi2vK4!k0^We8O^|+K`D( zyXzGUZ%-HSaAlf{qh`I+tymwQB&BgWQSw5!wHNv@RQ-9wY%K7yW}FDxqq%?(cu6=I zK{U2fWx#=gCI!L?J$bAB2NW*&lP_+{eE=TA?tQO$sYpO3KKe9HRBT1a4OJ8PIvtyW zVrEQwI`SY{p&vtLB|JXc9oHSJfVESvvIW#ixA$D1AkJpK+2L4PpLH)GXR~VV%29;) z_5WSxyonG$qysV$B_*i}qNIM`V4uy+_WJn-+hdc?SzlPO&iDk2K*SL1OrR-iM-h^3 z;0Cv!v1YSAY+wqf&-h90V4ap{N1{kX?+=HVNh*+NZVbZHMZ(T0N&WMT%~eP!t1VF=MU|UnI%2qQ_Kj21UIofEEbk2Zbu%=LTqwFrRQKN$h60R zyd&(Uuc(=sNgoVUv8+1YuomJD=XS&acd05b=>4CSdk4aWDE^3|CN8RAOF?Ic5c(^K zv7&NR+HYX5enAe~K$Sf%&V+y8NI#k2aGudz^0!hz)^9=*2{;pYw%xQCdSj#RM@UfC zu0S=4oBDQ`KO9u$7Xo zEU3M>{Dm$s_3!^|p9t0)&1gX%Ttt}`iObS?ZR!4$qLHb3BR}=-wLcWUxa%2kf+Ddb zg$1SW$C~4z&{u@k|Fdr%AH;kGcnE=-<$~KP12X*}Ult{85kCV**8Y)eAA`tRuH3>=*|M|`>$Ls^xv^PYYG6VEi0?P9-a(3`> zn3tgsjBeIO%qa2PFR&WSlIcw0;8JY6-v#!&n_7z|VEc=31O~g`BCqdRr(C!7qt6?N zFT0rRwi|xdS{wr$Q6$hsDyF+Het4_h)->=s9=<)2Y`qZ+?}$2Y2f0zH-}LT8u6BD; zm7@@We0+ZIJ5KT-_*reCh4V_#w+T!DR8Foy6|eUmA0@ddbNO<>9d-Bh))Yxz~z) zv0!l7j4|EHtYN4#n%3qGr#Af*6KbiwwD=|IjQ%kYzgqi^K&Fvf{Y3zQ^~G~z-&?=~ z?-M^9%T&Nv9s`y9bQw$&C&Q5%^7;ubsK15*kcbgp$^dYFmI=D8=VV%*s}kpz-^x~| z?f@^HQOf8wLPc$5J4T!UzL*5!7*Mp>FGYy-kPQgP+?yZ%aG^gur^mOoINUK$a#fiw!!(EWE^7z#RS z5y{mPb;g-w&C}XJc_RpY(#bKOFd>4r(G;s&*NCR5p21oHMX0r;QDHY+e zrq8*L99=oU5ISlXQInzwbczZ?rlsuHF|i+#GOl)m)v4O8l+XxhiOGUm1+NHM0jMW*~C>Ge&!uBrYk_a1v+eM4?YYEceO?nQ|nB@#%u8Ux>j*-usIp81VAiDoJ_7SYkI#e#-%?lgD{=7AoTESg1^Ix zIG^i&4I1KBTR9B`{OQ_V`eK!Hk{URcfLm=|1*;&x7RBMg3KTsOYKWp}u5k%LwZ5{w z(g&tJla$ zd^PkbGz<8}Z@T8cz>QV`JEf1+@e_f@$XE6kgi?>*P0ZQsGtoMi4fbv~Nm z>Tv!t*26bE7*KC4ofP(J#vQInjSNglK|-DyNd)nn8xe%&QL71%;sNP=gbQh2lf2Mm zi!I*qwdBD#@TP`n(#*00tXSPRYy+mN?OL(P`)Ppf(i$;Y-kU+r9P2FKZ3@v;gtlu5 zqN{PDCJ{{QWRi*!|qnX_~tPiJ|TH{-ayF}%1G~q5Kpuk(YGN_ zBreyQUJ8uJ*U?eype+s#k(A<`yEn|`?Jr;rF*2F79ymTaBYXWlaLQB; z5hEjN)Wr_KN%ok2Wnio)gx$p--k11v^#)grO15}L+Yho;=lyWLY92FDQlH=sl)}vsR1wZs{k< z0GI2rEPa2h)K4Q44lT*fjgUaC$jZ?N%%U^;Nk}&QtnTTELL^*Bk3UUgt1?`Xb_yNl zZm$pDaLKYf;3$}ac$Kssl6XH5<-M98$hV4f2#duLv1`|hl(PZHG+}T}zN*{Md8SLTP?uAqRfpKfE_Sg0T27(!#KhzAYsjksPjPphC7@>F_!1Zi z>lZPFQL3i#VljG|MsmC^okVb6!u6jnNMspn7w&9eV~1bou8WT=el7}9hKBj0&pYCR zoVdmKvjj2dCd%_U$c`-X!ej}!>RfTW_ugXK;tWOzQ&$E;_@*dIr%l<7SM9;UhlqeT z84iKS{3~SUP93c~))W!l>N9ce6CKhdU}1j*II?7X3@M#C9z*keL4J%|DUE#?!}alG zQq`l_Z0n8qUz#Hp{tPG)F64)!8^q~dkn>v>xK!qlq}-ZMq`}!FyNmH^2-ES<_!(%) zE9dQTPcZ)v!$3U0f1)>PB8Z_;8xoaYNcw2063<0zX+1bb(wm&u$m`7>#Cg^MQc&4I zO4I$xo6qTFle-03aygV9EhjsMIFqTDqDaZREkw<_A4#EADe~G{7qlFDF1$vnsg%CiFoM`jIYmknuT$C9A@7o_ zNk!r-(nh}@VQTrFG2O|!yD?0*$mQkkWYLuf^7ZmmB4_MQQY!=`^~H8#(|bL8d_+r- zqd^%&K=0|vrkALCzsZF{| ztgU*HINJPGBs?c=6}z%Jdub07vhFrhXUfRhzMaU@dokqRJS#H!Ts#fqlLdAl_7kpA zH`T9$9LS}J6tdjah%9+r$cDwfK0yM7P9e$nNGp>rBtztFWUsp_nSLXVJY3>Rnp=$| zTej~aFCy|pN54}Md7Icfb|(Q@0#a9+O73_^kc68Hh@T}C(sR;2Qb9xW15c73gO=0!6G^BE zNlt!9CH(4S(p|@d1kkp{dxJBv9(9o(C!{X%DpAsQC0W$NsVXK<9$q1|DHqd(8#iu{ zva%nohCd3Mjy@#f&ePuwZay|GnTFxRhhhBUt;nqtg|nz($^dP={*Z<64^eRFU<5}C zGsMMZ;%T@f2KQ=B&lf;mUS8PiR@TJOVMC}}8g@3V5Fek3M;EW6^4DYA`6+LUH znOk8(Hv`D%SU|U^0I4)BiDoS@+{2A62amD6;s3-7x6fUJ)2ubnl?4oXPJ~5$D7;IG zA*XJI(E~csvlL-%03^gF;>e{BFt=%m;CDVK)-*u+%Ueh*=0Q?-Fg&c9LqXRHt@ufZ z<tU}c3AMIv7-^i1GoQ6FePBz3#?`_1!&fX? zJqI5iJ%k`G91Y#OK|@v<3PqtfaOp1m{6E98&kU$E*=~VLWkR``=rvFyQqtfF>QE}F zg}1pWm}OdxQ|FJMyPhS^g*BP7!pp&yr&XfWq^(-)|cRN5*la_}Op51zY z)Auv5blZ3+K@NS_%|zbQo5(8TLb06(dYULf#l#v~+%zQS$KgsqIohaH;Qf0)$Z9L& z>CM-WpcT4}>qr=>NWjRZBkD4vP)T#9BqM=l8d~%?&_Y8SpRXUr?RS2NYiNVM);jF% ziTMSP3LIQN3&VyD$JklRktm#*^^K9^dcg0)X9THT z_>fajfE4q7MphBshKz@zlmt3;GDUiHG+tl34BgS|(M}0aF)&4QZ8cQa`r%oQ85WLW z>Wms@&F_jkSKeayj9Ezd5&;ywL}iy#=u&zU@eRP|>N51RG=i3@46g0nf;S&NpweIr zoEqPZGVr)m>{Wjl@n(>rbu_<(2hW4=5P5MFUfjKk<-?uPcm8!z3?Z-2ABL9uHaP1^ zKwjMlBYWB6_`b{VShfn<(h@KqIU8z8-U!XEgp7$TCiF9cl(G%zHD+dvBTp z8Q8W}!q?a|+`D!k+UENB^8P(isTp1t@EFnA4OEBNV@!7=NGh4Yym=|2vzRtO9@26u z?5MiDk|tye-{au*C-4vd3P-nz-`=E&`Qt-va`D@Yza26yvE$fPJbwHHcaCp`&QBJ8 z7(BW+LM|P_gER|tZvoi1Z-an0cM+>#fj+Hh1YVOFfK-5(4{8~Bd_HZI3A?I}tenV9 zmXL%b)zgF?V^+Iqgjpe{uBsYJo?{{D^AuMfy@kV&5$N7g8rQF1hGE-&G?omGz4gQ5 zp4y22cn94b+9R+;cs_%SWhY2w1tahKX0DVH#3TYPR?O=tIp}qpiG<_?L_VB_D?3jL zqlgd)0BPx_;xAxV{%PFkmF5ysG!mcrDw!wxNRBFf<^yHn{CVo8k=eUq%7L+rD9jR_ zGSnbq{z@@7&mu`13Mtx`p_!#WQIWBmRy9yhOCSw~@BzzKnH}Q>(Xb2?qV5~vi(#_Ft?h)i>CE?sm73@FxRv3qY=8-UR-o(HM z%_Gw+G*$x%X&HKZ%=~u(K37!NxjcF=A~~dP33?x_q%*5viGm4V0!;PdlO}bFrX@-1 z6thGw_>FanrY$KzWoZRXw+00{nMg^DL#0X&oH;ZVocekiRaCgl&drjv9qw-?3Leq&&TdGvPWI zN$t+ImNrNZxQkCYQncfvOk*^y2vq+!2(=@ReOAmO4!j@Q17@2LR{1t*4LmlmLUi8C0v{ zkn)q&27*2p!^MV~Fd_lHPD2qK6^FRM-S9fG8~NW=DVrrJnWhzi38S^6i4JG>8|Se) zoQrx^e0ktgMbID;Ww!kgRs?pyh=pwrWNBJ_TF<`KDz@&kZHA}~VBoX+r|?l;R)pHJ zLfRfABPy~2E3aHadkrqFAN0DS;^s5|zO@IUJn9TU#Fuxll&!$?!xPb_&kCADF@GNZ zgRS$${58=SJQ5{$4$gVVXi_m7K=iRGCJ*wzdII zy`2#HM)(0`YLGV)v&+%kXd2qryugES=F@f_u3QX;+h9kk^P} zy6IT8Z6^{%27K^`SXlLN5qd-n95(_V&u>97)vwG-8i8L*v3Pdo9vZ)|pbGQ*$~;WtLydCklA!9(9<(Q zQBg4)n)~J$9+wzn>f{O7vuO@8zQnQNV*Ycw_3w(yYqmjav^(qX-p>S^7pzCuZmz6f zK#gz?^FWwqLygPEXUZ5PL{S@k9Od!!X*wJB__aT+8};ZkbUgAN9zZ4|DkVX<86%6) zJ(SVfxd)Oj%|ddsanMju#ljACn13`J-MU!=@%OOlZ7HTtn}p3rcR(ub3(A|k)v_3| z99@#`V)MNKVdKlqz|5I@(SO}h=%+u%xZO8U&598pL4l>{)yA(p z-FwH$=$vu0z~ zBo9_Xg>1=qZD+3?%v-obT959%_9gX}#ly`zoArhr5LVesF(7WFO@A&XLM+jkm0 zC(ppl<(uKzMjByFR})g`h?OI(uyNW(2%8Bm-X56)Kix%GJgOVQ$#8z&v3_+Q)k(_QS$BvvRm21PG1GJbq$QzQka$E z=)H@KWTri2nnPwiX~I~`lonD(hV}u#KfsH*!I9tryg9|v27sCYIJN=VOi5l=<2sYS*frb8v-w4?`KI& zn=%pmX}ML$h11TAm_HL@gIvr{aKtcIL%7*7uM;Wy9pP@)8Lp$4QEQ4+GdOp#gA`Rp zCU%`*peh_yXr^ZYD;;@soOA-iIo=pJ#1j`1R4}-=C2FaXdHD1kUhbNRVMF?%de}+q zA1?e*Z_wC*=rLZHc1veh7}~VM!~sK(c5R)v}Xx~_V*ALT7 zk}zcOaE$Qqz&p9YRH-he%GnUZjO#FAq&r59aL0j|cKCQ}f#@tD?MCjwm1zbTGH@7% zdyc~8PZ=0`b5jeJFy1_MJOHMMkJqTU&R6j%zsQv`(AJ`(SS!MeWAbCMA(};qfZZJ+7%$LZU6^n&JmSuhc2C< zBpL)Xv~qx!YICf-{|vQ9C&7KnJXFx<kr8qi*ARs1FRAzSWX7!{e_Xq2#w0 z9z#cB=+Mc~oqYorraJ&8{oq{wjD}GeAL@aeuDfx35;M)x zSk@AUA3i|Nt@#-0IRM_RXXC*FX9yH^U}ws_BBLrmMF;kl!g7FIb9QIddHTyT)NSt;cQp^uYP$%smdn3o-!@ zwu^L?nEwLC7(Unx1MO{v-sUD4Vde~*NmE36P!1hkoS{f9MZNZ&V5u#fBq68W7WQVE zFzdSkD-BZNHe?8Pe5}WaL3UtrJD zgvaS*JbQQ%O4QJ|?PL#Gc2HUZ)}1<|nW*lYc5*}uS}4q$p*IKSV$!I=I8)mPA9weI zro&9!T-+8OZbRX={4#djc?*5oGMYMef~JDd3~OQ90Vd7mVNL7rbp25D8BFh$-p7t7 z*-%z$jxJ7i>;eD`ruJRXLb?IE|3z0{Rn7<{8m^6JBm;rw= zV*bup_n!iHGx6t?V*Y)^2Dun9{~>)Qtw2v>@#wgizcWf$xM~eriATr9{LQf+u@sZ+ zm@lxzi23C(-v@{daxr4Wh!G=3j2JOu{#Q_oTx^hw`9ne~(s1U$Mr^w5B?|d@_LK7vCp{LVg}TpIK5+K^L;9~l?0?SW|NlRqe5eQx2=XYp!4VwxZ!Hps;^r7i*eT1miTpPwiI zsEL1!wyiXAz_%1tQ5WFgwo-KDx8?MTF^G`tfT^CY*y+&$7a~hVN17tQqa8ERclam_ z?dyc`Tkf-=I|sMNg{Yq_Nc%tL+0k{l`=t`q;iuv3v0fDV%Xqqe5EfqfBJ>moz@nWS z@`OGyzX3(T=V8!72bV&bWjcj?IX4LsExRC`8k7FJJTP#Ra4Emv6n+uLPgsW5y~m)3 zUKIvg_Ck{A&=1t*VAIq=@EA1)13Q~x$ID`Xn~nkIJ&`Pm^2eYGyA~}*G6(S8=8i$z zd_>{DjOATT@i1Mu&UNOS?Qj{pk9CXrttiFhHWF}Nc2DG|BAFWq2R&KLx|9e(-Yc|s zn!v7_@>}zG_f$MBG{V%8Zn!$LJ9fSnE-Cs`J{((u9>YdrxLXgnFFwJBU7XSNXXF2` z2)Mij2i|0ZJB9oqzk&%V+T9FzO)Uxq1^BaxsN<5D#M89rbV4y0Eq_43^Oi4je zP7#`{Jd4Q7vvD-h4(}e_$7Anz=r5Ou6dImP<0pyYvn$V%pQcYugX$Xgep8ZjM9Q#% z#z{j4J?EcMRh)(Nj7%CQ1J$Cz7hYWz>Nq?UyRienqxZ!Hx2gbX>Dg!yjpoQJ zDnnixP&RPHl+oXJ)GRB^5tdEh_^RfF*EaYo4=(7dd_85aPuHRRF$;qP6kCtn0DU~UH18O;ZDla+6D-x~(TqSx& zCH3Ej_8LkHs65fe(I0B)mdiejefz;*nBZLgNd!65?0?m_7)Xt+N7p-OOxJ z-KZ~R<7A8S{sV-E!W@x&=6v52pthzOd`=B}USX*)ZNjZXbpsC-g|yyKITRuZrDn|_ zNi%QiO3Sdji6|V%&J>j))iWRsv`lGzrT)yq#%++Q5FeL>?1t(})HXCAKbzi5UXwRdHDzoa$jHn_Wxc52#rzChWYRuq#Z>nPDV+7A?ljE5=wu)4NIRX z!te0|Jbe8gQ(ERBfIi}k#5fv1g^e$i&Yz}F#iF{JD$jb_9%PB)@M&IYdqDN@KO1YW zEu(c>)E<!?mCq3uB?szg;!RzVqxvJ#Ncw!+NG z?%#Htt}6LnhKzJp6bj2GBQxh)+n1FbOY3$r^2*Cl&r!wX`Lm%b`hLX4R}220B(8+ZKPaI$guQX*!$tHZCb9R_sB$ND|-=x;9rp2Y}s zll8;=10k3>z7JBK?ZAW`_feD{j|&f;qpeAE4DT}lxf~86zciqebuAW7o{yl^Ok6l| z7P1CiVP#N(*&eeIK^xV;chB)Cwi=#Y4Y6~^DBO+A!@I{95mVM0b}EtByyGfL>t!LR zOUL5}kC5LWh1Bpo*bH!jifCi9u={)QFvA@4$2d}-ENoo5LNUz?+YVesAzupVk;Q1= zy){nE9*?_GdGLO89#Mt5aJ4tUOc!Ik%;6)@ z1%^9^7UD%@8OKVJ10@wX$ras-eK{vD9jks6G@LYW73`{C`yaN*?Ui5W?_$KXE)$eWClKc zxPzNva`5b|f@8b4(|i+@r{_b{P#T+7oyUZE<51#r8k07hp~g%kjvRXdhd~2T?Y#+h z!w*o~DHD&*U4T!C7Tg?6aA^Ky-2V`TxR@~9xbp-(h7M-8TmB=HP8${#6%{mZ-dq&& z`%szu0k856;ZPg^36H605qb`<8XVC&HyDmH7NO?BS{zR?!?+&Cc)oKaR@_cPX}mYK zJj;S-^UrXeyce~lS;($4gj&Hp%-C?AKBF)kKK=#{Zf;O1euME7_8_A$4KJ^pKx&Kb z=pqx2iPM%NDl;8tj$J`3``)MwIEQ1m1F3Z>hk}BSc<>?+0%;!Ypz-0<#ay^cEUIyQ z+a^fa&%$8lLo&sd=;GWSXT!QJCk&q48kIvH%(N1|GZXZ1gf1WY=+P22!{YTJe=?awGT8lGTmKfX3 z0FSnh!0NlyV2XWRy=lH z%f{4Uo#At68rIwlMrPbg9J-K#k;A*-#`qqXa4QV_{4Y4W`4DP44?#zb6io44im$X& z@!{!Ryv>opASZLt-TgTT3JQX=GqW!D??ENi-A^%UydB;|DPdSQMQq&o79RatAXTXs zCbY}KwB@%kcg9c@`klte)n`$VnT%TxAE0?#3#{zh9-&o|hzKl%Lr+a?oH!A0<8$%& z##t0fS;Nsn5u3(OgjYl&B18Oe>-k3vcJGa|^E_}eC=a1tSK%Gk41KN3v2DXKWLHUm zLyb`H*SC;TCV{-zOc=R1K}$|p6H>iTVU zx}g^3#kn9GYCZ(x+azQ9nkSeu%>#Kp$1rOBB@|{P;rfGn&@gpHz{N%I3d=!g z@I#z!w$sNgp2RWoB{1`ECT1X?tlJ*AHB%nxm z8WC_wLw*3!Hf&G6RtbZ)_0%Gh&&3Hn(I<(T%?J|td>euOcwrbtK!5M|3?&Xz&je0c{Iax_v{ z-XC_k6UXW2SU0KpOiWw1CCSt|ynRb@F|?cw4n8uDbYFCbbrVuTJS{EB$1;((3F%)W zNlaWQ>7uJn9%d8rd0Tg4yY!y$VDf3AYUxP|i=v5^u|3IW1G!|Nu@pIADG*9zco+$OeSyd-*^&zCe>ATH8GGuB@L;JQ zQCD{+)ufyZwJ;#p;)TJHhei?O=~qeW;}t~PWtlLr@HH_tn?MNf4S|FSq1g~pmrppN zYyFY&@$n&viHRcLf0^1mwhp|0^^*8TrHKNCWWC-*EC%l&m4RD{^Qiq~&-9VxT}cHQ zWTZp9=>zdy+nID(`+*dH+Cy}lXNu0E;#E)2eYKGo4qhn=$s_$u4avPEp)YXv5Ms07 z4tcoPhBz#IA`D~@RFai0+GPIS9HIZ?P9kqJo>UZtlGfd)3d4A*#7d^gGi*Z6oBhPP zofXkgQ6&Qw9w*twG*FOEgM9z8~DarOHEi7G0p-2`s^lC#^ zy{Qp;DjpK^HXcMIo=xD9(9kdv@Z<W>D8(Q`9v@Ac7+q^y2+p9`)nin-RBGAQOe63>vCjr6gfMlIvbLuxS?^O!o-TGG{q{!@l6i-;G#f>aqRpzc;p@t zPg(i9LAXdw{)*U`7{n!|q2VX*;{?10$ZI=eYWpAzKL~8&R8~QnkAeN&rNX8p|CojbGNfYrb zS%8S3FK}|}EsUpVjxK7F2u!aAwJ1z~iC5<{w|HN$PdR^Pn)?I(G)khBSw} zqXVL8xCA}7zE&9jlW!!Pzop*}omGL*%t}ZqYraaVy%4*Gx?<+Oy9f)71GlOHg;jOzoUi6Ot%XrcY@uD6hmuMfu3-S-vgFcm)>o(H zTnK4q`!))*t+I@qJor(sP}-^&+KX1ll9W*fDG9;C?v~hoI{;r2G9X`5jBI+0%jJPn zFPcKYCy_W%v>oinC`=peOGE zjJixlWeuO!AwJmeCpnpT_f-a-14TPtcBSd3B_OY&8q%7E&|+kPpN9`gMfm!3E0!%@ zf~A}8K_JINU6VOtRhhn++oJ>aJP1W}QVwK`i@Co1v+yDkJs7MU3h_7`J^Q@in&+$P`X_ z;PUvW6X^i~ql;waQ5N(DJPQvPh~&9v|1Jm*jAHAEmX019CMl$ep4`B&jF zdpRagoC=@xe`n_IUll&GsVv0A#3C*s1&y-^8)4*6Qri+MhnB&8#z!ofdN)7LVW{a>o$;eGwJs;R>zx=GDs_`!NNeB4gC@lg5s1&h^oFwt4~<4m6&J;2v`wMqq0%VxswU9qRv@p0%Diez=rUV6 zQ*14ak(!hRDJhZZB_RoE8QP{61|vhK}S#1MkwM24JlQOo;(-JmM_PmDI=l&(^)i(Ax!^_UV9e%_fBJ9 zi}RYy(<6L7B=k%mQ=UQ1?j|r%1Om|PU^EIji?$KO=MFs z@Pp1^%V%laIlluFCrp5|kt7;tcrnHqOAgJ8ax17PNj8~t$VXBh4~DH(zg>%gDMKk* zhEk=eXu9r7=!H$Vr#T(>_RPohh4X21(ZCifp?RfNk1!H7Xb3GEIdv^)NR%K?G-1{( zP89eZA`nXQ$~~vBcl}`MsuLO^A{d#}rsbWV^5bWdOoxkoUJM%AP!*IQUu4u)(r2XD zN*jFI;SEbm#HGXg(Z2i=rXP3@OI=AMWeDS;Fde0;s!&moXQ#Wd(7$~8+#9#f{sy-e z$?SIzau_yh9G0Kh1+~mb6jg8`py#mhWz}Gy#`&Ipei};E)S$w2uBj}tNXeo(?KJkE zz6E=BZNrwWXAu#4A39B{-KR6_;BB}NcX!Uj%q26RBO@}*D3bJihQjnrXtdT7=9|hM z3#SkzL=D>NazClpe6(z>i@X%(%a89|*f0~y6VBt{ipf|ubs!XFgq;#*;S4Eiyf82+ zGv%z>+8Ba@BnUtC1hUdnphKSv^L&`}8JN7#r-FKkmUx_+gU6@#V~BAQhR-_49{+oz zfI(wsVfpf9SUhXuKUqg!fLf|!dapcz9jm5Noy2sEzH2x_ABv=UD=2gFQP`+3 z@7HAXn}kT-no^aW#I{MsP9B)ObQ>mil*h+#Dl?Mw`HSM~80sK5rLiK^A+f9+ruypa zN?kmWyvWnG%G_}XcJ19m+k>5W85NHO_DxKslvh~)G8GrDAE6z)3Fu>`1g=P~B_u`h zs&i2;se$IIGVIDnjm=kDdI|JeH>a}sy&f7Hp&Fl8 zkBYJqK*a-#I!0l}s&fbl{DebC58_K|HC5cTB4bnz+xE`EgEh18IwTNVCv8W!85_|u z`xbhRUW$OwNZNDPf}^7aMlIWn@;j?=!!Huo_HIVK*%WkD0!qs(z!fPi*MWWE|Kv7& zy~BPmVB;TegX{EN2nhK0t`atJCz3}PrEqwBeL*HdvQFeP3ZqoFx?%srk zc2m%qHaewc-_swybPF2Z9>$H2QHY8Dg7f>9A+E`Qyp&BJbX2LrlUIRw|M)mAL@@^m zYlIZW`XeUn1E!4Ij()2)Lq}BtQe~NV7Z8RgCzs)o%2+J0kfYZtM{NTSe6FYrn~%f- zn-EN2bCH(eM;ttH6au5(P|lCS$KWtrKe!gLw0pytB2Ilgk?3~^A87t^%WF_wQ3k$@ zDOQit#j3^o5fc6ei?)2i+O<=`uPaAIwa7f-b5K>?0J+L240ZRw(@&Ae%aMeIixZlQ z_c8iem}gW~E$r!74VjH09hf=n98_0UQe%X=>Z;i1X)$gCEaR4A<;713dH)de_ui!^ z^HE(V`f^Lv0joUKuzKlXghsr=(w(8$v}p$XPR_)Xt=AA05ek8-H5|J1#>Nf9ac;p3 zy!-qKYi1mU`{MOztyG87O3_H5iat8qE8^Az9|Q#@vLAf0Nb_)cwL2#6d5n;dkJvYB z6P%~5fQhaN96BiA=EDz&jIP0!onvrj-Yho#RWpynW9bIyHccPRv327p+}*JWKH<@b z3=6@*{aexW^E>Nq10hKNjL%`=IKOKn;%H$onp8%>LHI{6M18u08OOh3>*@)tF#u!u-hlh)|g)s{Uj=I5Z#u%Z$i=F4;yJFHzblnt$~t)encH4~3R zbs6(9ur*cv-4sJ`EX6JC*cbZ!fxl}2KwAy86U0gk96;L?8(BH!G`N1qTB zbG{quIeur*dBkeAJ$QCwH~gxcvD5{ybM24tx3}Q`@e8abtb^Kz%{b*9iHB#mAg2&EpWa-@u@~8_Q7kDf zgNo!(dS5F3uGl$a1wMwo$NVKXF=Nwus7O?ytWq>EM%(x5sv5|1GBIuBAl&kaLPkmzj2)aH zdRZ*ye+v1}KI&v&-O9>BT3VX^q}ZODl#C3u^2xuo9xfxu%p3h*yOuPQ54k4!V5Thm zTv8Gegc_K2kfiziz07i^vi>PP>XcG|iD^4@Y;XSU%XtQM9Ya{z*ub!*7EH`6VQJc$ zD!v7f%@0LXTqv*$2Or0Kt<=~ruZ!ts6cX!-=Y z21c;5vVgJ-AggJHk$ueY^2K{hH)3F}TB zQ1$5=uEhezid-o7oQFN*?Saa496WLjCME_bK}#Gxyn%fSp{_&kr@amITWGUoXwg;= zE~6GgDklVA;?p3bVS?dfr@*mgCHzCaK(WIJ%rGPbRn&zMUUCQl6gfTtqh~Krm%K$MK65<|IjZ;Ez!cE z)0?36C+Ld*uRiLORn~;5g*7bNG?4*FL(jM^+S^*8MGJkjv$lb$ZflI3Ivz28Z;_Ex zg0>wy!>NN6j7`j7uCK+OWz}~gG%Ldp6qW_YxtlT7Ne4y_JyD-RpF5RXeb8SE+LU?aEQbO8tP%Aw5M_00u(dT5e$*);ho1d= zA}!n>S(!PIFdL4eYdq)yN%Ze$g-E{u6jdo>;P^Q-{Zg8KJXHG9^e5BwCFQ7`Hl`1> zupNXR1{LuB^aZ(jxv=Up^M{W*RoZlgje0Sa&uFMSj>Bv>7qquB!-pG(kU*&H)mEeT z{H+*ft%8ySADnrSh_;$?s5k0Mjj*9?yU?0mk10cKT80+Z)-csGz^KWi5&8Z#GIPsd z(xD3mkDCVhq9{ZqWT4})B^cGmmev`4bm-j+<#GN<$PmE6%@yrUEnsfa5`8C5L1Dyu z#HG|>#^KX&RF{Sd)mgT79bnvC4${rE(YBox?bwe%tD0zpL?uAVzzs*1HcpNB^YHtA z)F}glHs-MHU<2jGWk4t@EexnGvqjt1+Awb04we?iXzw-)x^=M#j!p(q)J4ypUD2*h z8>(a5L6+(o1)UBUWTy(B_ra()?1NM5MngiQ9lB~)!9P3>`MkC`eRwgHl{7JSh$DPn zd7(_!1P70;gEAF#Ej=Sx(6&)SK@$3%T%l4Nim>=fm^s)|{VG&un$|sGf((47c_?aV zj`b(^z(5YrW#Siwvij3{pgZOabHck9UMQvMA3C-cN;G|Kn!crlCDdv9QqA-*Vt5yL zKY4}x+$;zT24b`m?G-d4p@Bg?&1nbFA2~8@v1*nFI@mivD)lwayvv4(h7|biJaJ-S ze;TJ+f<&>@)6Dy6KgPwPQ@w9#t;leQMHvM@r2!E>Nh9mD3ID7M1D z(G%d&K?%P8Vc?j!VZ*TQXw%LH>V^(*P)|W%L@~6@ZPCr4BP?j%+cHE(qKk(!iUNZmFtmq7OZgwBI{X}x)Dq8& z2|}i%5jtD6_~CWfFM%<}YfDlQ9Q+krniiiU4GWhpFj1EWmwCVQ1CmfwF2e357cgYi z8W^eY*;hcnHOz80YHDgwQu_IIElNsC;N#bdH?=B^z`&t1uEu`%kn{1u-qMqDOTUDw$#VV;pt_Gs1s8}A!7a; z9HIu@k|j$-J~4kJ;;u}?ROJ9AHbOpHO}Cs$(rcig;r6K-y9tUdNe zW7E<5zjDfogcKy|3vq1MUesxr(B7Fjlxwq)TUn2c*eIlzHb6>Jf}O{!pdb%<1qJr6 zBqSh5dnR&na%`BKj1;7#Bv6tTgD>f2kdc<5;q*9-qdhMWxp$a zX4*h$dH~*pm!Z9l4fHi?aB1IJB))WO41I5oU9C(DPHw;^~{6=cIt|ZER!z1 zW@9{2o)zTf*n1Eo=I3x)dIy&${rE;hQp*uxj~myo79-}b&#KeU;MrF6ErkgE-mCCr zV-v$fjF`VTZ9I42-m>rebg)Po;??VC_~V&>V*Y5b)1IicEAsww7~{4k*$2TAb{O8X z6HJWTp!fL6=%A?x&DMr6YN1MPc4<^3`Qhm4i@1K}0?u7{h-w8s-rT;8H_xBo{HbGj z8(l<=W@$9j)`PW)9yqnBxOM#z-rm1~v**s^OFo}HE{A%&e{z+kaS>N9Ucf!ycxpH| zG0G*SprYLxW~Qca>De1vNJezJ0F{{mc<3F+8u6uR{;ZoZyd@c{oEqb@GSZ0fx`C6Y zF5*RCGGr7LP?hu%C(c~Jne(@hP+TK6%EkOF3Yz+8t?`prUy=%FYp5&oh!OMGhnY^G zCikPBlvdV)A#Df5i21u9tI`q%TFpehMr2@UZ1ip8A2DKn4rYM(SB;P}Uj-|)Fo$++ zJZ?XFh5U+ob`=R}Sw7-|J|ex6D(8||9J}p{o`c7tpQAA%Kl!6pMu5=QuTi3EjY&i7 z;6sh`e4aG&V*?PCQ3YvIhIjX$LfLi@+-#L__1X&%YD|CizJ~Wj+891+1Ple4_!ynV zPF4Bd1W=cN`AS-V(yT<}N$J3*wF)W<5)m4k!;Z+;6eY248EN52jhFQkq8!QN0Adio~N z)>5IhRRCEHeK=aTg=!mPsMeOCs)i3~8Cgg((^H55%7*snWZD9nZH>Xt%Y`Jj6z_wQ zFks+dXsW8g%F2`(+-84`Fw;zmqP=nCz&5Nu^$Am#u7;r^vrL)vHv?Q!^1GWc;H4!v z2nh*+YAbzIm6bqEq8!l~TqsM`BhWtp6|#yj(A4_XADaG|sm_jqx3>@dy+c8hb%+ZB zZ(=|%2e_@fioBq^aO>>|w>77c93PMJpDt+rZ%_~$4li$S_(vv*LPRv=(VuXbR!uP{__`LH*P(;f2)h2$1%B)CuzZ2d|p=e3xe-A!VVuRrK!51Iizr(wb zAD3ur3b#5RF<-MpzF$vmaVmVhyz!o1lUdOs;G-YCUxk~~i~s=N9Z5t%R4;_ah}Wk2 zJxPxEgm+YSJ_LmSU~+#tIu(wteX;yT2)>-3P2K&l;Pi8(C8htr^7ya#>i2=l>N`Yb zHeE{ysL73G>p_HQO|#mfGz5I|!v|Uq-g)^TF8hZCNdGB`jrS7tbyeThX;%}*9I|2HU4j%M3~kD)Q5kVeYc zdf*oriaJJ!c~yuC4`$ng_df679~>`iC;kNugd^L2zgo0%_g%@uBTsSh{#9;I9OIn7_&(XJF>LsJAqP zxvdjsFJ6H@rWJVgE(J0&jL|CrW;JOH z`OI3Q%qY0VPZeREFGk6I{@p}EJFvi5_koEp(ilw)zTAb`ph+?nAKN= z(OD#DGCZ1AMNuXa;!~jM=m}esmKZl{CM;DeaCYl@JdMm_=ehr#2)VcmQ|BE-P<$K` zg709c+bjfR3zvX9xNkGY9Sy?kofC0%-v*355{%coXJhMxp?H(pWSzi&gQ|>|n6_j$ zl9E$!Zv99sxbT?`ugeO-%9*S2Aug60xyeF9C-emD`^eaZ$beZ0W_DKicc{<7Kr3h5_#DMj3H zi+sPH`tm$PhJ@j3LJ)>K+u`^#e|(7u$JZ2Qy=gJOJsez|I~(iHKS4}f9NypEg!h9pqm_^pka%zwZ%Jqx~^$L~q=W z7S_4+x5qJe-8p=YjznUPaJMSoLz6LZ**V0=#ULy+9BBpr%Ccy{d8*SkTztyji_gs+ z=reBr56g%C5~`wap-0yV_?Y+=adF|;J$oqT9e*S``Xhm-=40U*VLkp&C`wB}XhakO zU!8%S!w`I=`40<;KyKN;S%<~^YErz;V$%4{@Q;tj*RYqEJajx>eicgjwWDj{xb7WZ zA76>rXII01&3n8)u>rSNjl=cuU#F`$B|(@tdmR#KdvJH}Obp-snhocdBw*9Txp+<6 zrRbQi;4qDO`YUvE9gTNi64~~ES*_|{8RSWCPGRz-t)hE*jtQO<@j9{T!k)hbKIU|C z#*w!nh@N%)*z3mvUy;B(6H?tvE!`t$`SItVhBJ<(RN1U?_r z(4~(9s?);p;(a2zdbl9snIFu%^+YSxDtJE$hIQ{=sEYAMuCg6E=~v^0S0;K7=nRRv zbiDD&M&BW>DE#~$S@LaRXDElTcW;ouYlYtSZG@ZDNXeigI|88@3h3c%g|=<<@c!Bn zlxn-cSh0{AZx!g-(;DF~?;@UK1ov**cy-?&R(<+GyE+MpytbG$#tp`*%&IW8DB`K2 zd)Kaz$qhz|R9iT<(PTRn{|SGVWe-V#KV02+;_yc=jPB|Hhi-$>f$xRko8DrETXU@5 zcm^_x>fl$z;MB#(kd#z{wuuo8wN=s1&IwuylE@5sg3~u&AlTm*h05(<-ck`C9$&=0 zr(TH3mx8^8aQD1M%BuP3J8TmA^l(Ox)+Ly;-482f4#ej1p3t3p25ZOkgS|~Vb`Bmd z;{(oyXyVa@P3YXk1s$yngiF8u69jo5&|}CUoD6)85nY&jafeOAYYf}qjipoE@Z{PP zloo~K*8P{rDpQA*sc@IJ^x(%hbMq-aMVG?C-V9Qt5+}A@$L_cH;qK@J_mN{!^>#fL zU97~MQO@vs@&E#EF;1TkgoSHIv}~adWty&k1+z|w8UEq7=JSLrfgo*uKU}G-aY0>-sc|3UGh1eoF*qQ4> zP?mxV=g;DUe+YbIGGJ+A1qCSrujluW{N*zqy?BfKS{*d!hvC@SJIJlpgjHK+S-v_v zK70%>f`ahzeH8RM*+cCQG}-Zgwd`T)i_KVaUx1en4x)>r16=!$MCqOB*b#36yULf? zaX$(Gd_aT0t($2eF5ot+Hu{#64xpy8Gu{F-`w;XUybp(8--4%$3#<%< z>og>KT|=tHLL6T)8eO_}hN;fa&(%(Ox)IBsNaN+beZqSgFbah?r(kPzTTFJ5!KH^W zs84!`>yJVqrE7}T>dZG0e7wGUfy#|H63Ud(!L%i~`C+*6P6l@_ZG)p@7mOJ0io46) z@S`h&CuH1421#j(9p`9-n%5VD#~#4>;o8gvH>U27YEMY zg?~gE+A>S({Y)ipVQLMR&dzYLQO4Ojsd#+j2wb{3!Js))uS#+G%z1cy_=Hk96PW2J zqa@}9j$L_*&>(*VP+jBPP7kCi1Gl^bkstIN_g_aq(ZB*l!Pju%jz47d+CfiU4!nva zTsV9IzMq2-`Lz@l9ZY{%_Vtg%@4D52iia+p5jdC{Uy6*6uBscJD35cXvX6_u)|bdI6)? zhhXXSz6f~r2zA^loI3LshK{z-(Qb`aa@ly3AOQ<{?+lSIt{_#G)-|57ilt=SRPD6i|d`rtJ})46c6F$8M! zasB);cz^s1zsN)wTG&E`3bg;*2Z*N~`^V2;BCSvrhAL?|c>F3-^A%ug$t>|Iz}vGY z@z~Fwwg;h5Z)XQ>#a}&U`-kKYz3gF7?5`UkmtdxR$PxtIKZj$-kK^Fs^H6Y^h9MnV zLaBL6C`xjmX*m$XZ0fOp&t5!xp8^>rIq-=TTIjWcEHxH*JZZF~ZfOYt6g66+xw14B z2LRhve%X1a?x(!Y}k?@?A);vd(OXv zfC_Ecv+LNtbqhY%w1sDPQ*fA_K>j9tp$14kUHxFu=4-w8aK})q}Fth21 zjvcL`p`;A+4)(A#kjLpwYY<*4K>epfa9?!^R$T_5R|jQ$`C5d~({r)QrvU>!2O#(1 zI;^?(<14K035#&g(aJp(avfEU5WI6F)$c$?+~i{Ohx-9I87EJ7e&Wp)jxefFX-7)0h%CFnJV?he=Z7sXg}eHOItjX&61M z8_uqsil|zGoAdhOVxa*%2D-tp{v86-{?oCXzXo?t9)|VQSrG0CDP+mUS@6Ac27GNZ zC^yrBgL5ZXnVUdfNfXXp9idX6fR$?wv2SwT?i_*5uS?OpcOMw4*C8vr7>C9WLbPN% z3>oBviwlO}Me>iYSUNg6K&CnmLGPa6ews1%uIi1F54TXPs*KYU$D&uiKG=LMoQb2m=UxI7m%J3jHx4g;Iot?dRP)naG%YN zFuvG49%rLuF=SYO#9my410M>ZC@%vd;C|n_UqK(oH%!6RGrLiemx|dQJ#alk3%$FV zA?D5=9C?+8glAi^>rNyay)5b$rtSBJOb+ef&p(Hb{XNlME(+tPZ5QqC`|~u^GT$ii zzF(W>a_i6m_$qG+_W>PodgdU!&jl)Y^61lN06azvLiyE2SoAm-5;bv{N%cjv5;bV_ zi{NJ37Pm`G;A+Ojgqa&@S{%%9ACF4oZWz$7Ke#Cmk@o9e_Wk83dVLiB8htUqGeSJV+@+J6UGj-J#f%P zY+?bjXd5u~WFqyTa>a8bxlLGGg3uDm_Lr3dxtsOm}iuahXE-l^0|y* zLwcg$#DhY8tW5KuoQ?^eL(t7*9K!N{UXt=(9YJslH}o_7KH^|JXezAg-{1uYI5}}B zRzAwY@L_%7wQnXa#87FAyNyxHZoy%ICoBXXF?RM5dX@y3UGM8@$Dt9og}b2tn0m|~90_?CS=eK+`%u`cBw^r$U2NRT zONV2_%R-DC>4IxhyQ1eVe~cN~A1@Bi!;5SI0*;Kq&QNK1403~oVlo1girMqT{EjR? zd7V_2mXO@s+<)trmtR1Ni;GE7Q4#wqroX(rJW^OxObQC(7(iiZXgm5y_|Va&z-Yk;q+8SVRg7^6B|Znlv3IeUUrApopZ0zah^8zLM;mBywlp zdUE3V7kaGVdtM3(Nm1cgsCpuVC_d_wHSh?>B^7NDgjYN#@R-OO|XsLJI0c;grC=Lx}b4 znxa(5tY9PHWtjU)K zLh7H-Ce~ALkQ}egL}$QOQd8eRIJ`2l-cFG$dQ>7j@n>lu0}We}dr6{#;KmULV;k}+ zjVaFtlJs^n(Q{bA9?JQ6oy=OihAf-Zn`oI&XT#j=El8N?60>`@Bo9-0tb0d4J90WK zgKX-hNjlHEL`vxW)^gcHe<*x>d`MzqqR97OrYMxH1M}z3A{#DyivoqLcWp^lKhG5T zL?m4z(CJRH(gKKXmkGkKd@rKyG+yL>OSE0oG2VuVF4B>f6eF&IQr${I*L zheIB&?n>O&z7ZY#PF3b-a_rDvvTgNp@;Z%>w969+IqWkXT_Xx@g|b3O9&ysPATiac#G$Pn@yVzsb#)vP z{b)Hc?Z1x*60Z?c)A6KA6q_aHB$2inPKq)=5#8=nMS+AoU*<%*Zu~?9X*Y>+&n0Zw zokd;Avd5X^-h3xA>fi^$tFI&chB(qs&w#xB;hz4H`t+wnTd()`YsZ}-O8Oooy@Dyv z26A_)Bk|nvi9O_fbq86pdNY~e(t>oF^_&Pw-VmMcGuUIKB8r&V_9m=`5@Zqw?H(kb z6cA@ERkG^V7h0#P$se#9{J_D32Su*`5`s!{e*ZeQE-YNPgQQi6!YNs|W)qEW8%4fG ziixY4JUJ3i$Og|2QMaEPmLu9+i+mW(MSVL=9=6 zI;TA4I%%csNK^bN)#Tyvtz_4(9c0%vs(E=~q*)6i@}WR@^u#E8;=bp{IvaLs3~ANl zr+NKO+O_FK!*!d;*GK{B)>fIEPAMfLO)SWx6k-1F%WO#FsyE#oIrGRv&ZQrXJLKeGOlLv{yGO3QcL3GSUu(8QcD_Y>qv3j z1=32hH(^?fnyANQ+Jcp2^_*cuS))H2duC57@+6sclI^40k|Tj-to!PWo@DjYL~>`Y z6|wNxN%CvzNi}V|{)*hVaf6hV3Ge%l#>OLe$*+DNK?Jm?#^Hd=<+48x{n0eR<8s)! z-V&0MC`}H-g9rEE6;q3GliVO(S5MF3f{Hzp0=ObKpT`x=HD}VK=`cr|y15Mq|L_d= z?>s`eVK0nyY(>xgKE;OcdEhpgawDMWvDXm@gn6WXE~kO!k%=P^U6(oub<_Md-UFY; z|8_s3y#3{n*1&{WOR#R;I;@yA4$Yekoi*3hM8?-xkxxWTDfk?D7^u?TIW1#aTon4u z=<^b~g)q-3w_FnXI!#_0mK33|ya^R_tgz`}UmDx1Rx`qL}gM?+hC;0u^6F@NL>3cVTfxgO0VhsGVAis+C`*Vzd1eTn0&8ge=D9nG0)^CV5KxIWXPVU=+b*oq7U1=K(aM2eX z{f=^Ld(2m2naGGnvP)|5b3Gx=`Y*dNh#P52J8LgYx%L<`Ui6Z|$qN5{? z#6;o8pp9^HlAxevgl0;z5Qy%DDm_TZ)S)0PA0?HAxP5X5HmqBX^WGI0F}e$TuRkR@ z$RFC;ouI71VZZrlgsBF6ZapLn-O;JQAGEgMvA-f_c(g`RaxxM>-NA+p>#=;z85j>A z4}*Vmm%#G0B-B)9;rJe=JlDXt#u}b3%Glb!E%ryKW7Yaim@>cu^+grnOG>ccC9yP6 z`KPka)&j;YDL^%}@#x+WWO<#!@~MN-w)Yy?s{KvJ%c-2(*0hVoO5psFobqZ}e8{KU2QGafJHFR|~*f5s*a^zK(;p6qaSifN% zwj2w@(B+fykB?sop7W@loYoB|r%yzwls5F0mC#)D=GK)y+n9(1p+`hVw~>&`iNKGw z_B(3yUMkYVeta9ltwwdF1T2l!!Q)XIg0^7{e8NR-O&zlGauNIPI@Z(nVENh$upB!c zdbCYq^?XxGQ;?gf19N&KJRVaH!n(rR57drf81G?=H!s8R>XsMW={+?hMxm}O1qXL- z!rIjv5GLh_-W~qUsd@B4FUy?zBOTWjKKB(tTznBNU5F2C9!|Cdlh zpg~FDHlMmCMqNb=81))dfHEfLW8-k+%vm@!Y7MrI zmdCw^UqIoi*roe;Sd&KfOkjSca(w9`h#O5t3CJNQoinxr$-??yYiN!pWlT`L>m00F zw;t=)Z^70%{a~U;I*ufy9~%vI8m9g-0S%@sAL9IeY^#fsHfPu$;iU=v!EHzil*z~`}df!Fbc(Q+MC{sA`5sAF%09y6Bc z;&baREFanc?)M&`=D1a;QcMV`CKK5z-Srw$)8^gErdM7Ell`lg9gizdV{q`$er(u! z0OK9Pu<7z23%ef|jcb*PaIHT8 zE7q*ThV`4UWA!g^BAtCrb^?68!gU{Se+tR3dGX9*UbQJ)EDSL>FFtqeMgJ;Bxb`{* zlU9y{HAzlcRwi+aRBmjU%)6I&M^_3+9mWVDQbfW{SQE$h@4&W`=V0Z132s68&-(EZ z!lH<-J+QMW2E77`z@*U#v`Bl5?RWB5zk0BJDZ-q`qlK8{0cC+Yg>4V=>Kc+4)B-&; zZ(b2M&tKJ960(&>Xj0k~bq6iN8d864*tiWFr*d;sz>U4lC|}X^9ECt zSUqJFN{m_xc5{6NX%F(^gmo{kJ!m~-6rS#!f#u$57~9SkrWNX`?-_Zn(hVk*aX*<^a+7a)cK7_--z0@4mzmQkFJu*n;J4#MpYugF8?8N(cmBa=m&Y%9a1l*YK<; zm&-pNp`rZC7*>Ou`w`5VJplJgSA&(@4}R(vczTlEs#yagQ!|L!RPMnT`<7%R)!X1)!hp_v=atxe25ch1Yq0UZ+aqTWxGpaLpAB&w-iD9F< zqgfqS_`JS{^}C-CTYa3pwFuqkjYeP@C8Db?#Nn=G;IVuV76qB0q6q`P#Hu)SuqWrn ztPbT7(Dpj+tYE8S9^+bg_-a39&FG8UBrKM4UlNvfcyeqaIT;00b5qh8Vf` zfgvUxyNYR3Mqv2$;xHGfkRi3jj^z_bLzRi;Q)Zx~o*I5$!Km4PC)N&QI~GbV9`f7~ zi1lG+qLc2T3a#OkItltimUHG}O{QU8^I_;PVhUU>LjQDm1K2av1zOT6G&9kq6zSH$+%)f4Opf(Q_sSG|_Rhh8`F-K*ToQ@N(HOGeG)^vk zjNyaFqI@wU#D9oJ>#1uosE#9dFNoxDOumW69dDvTNhO{q*1^$jjUki(H#b~C=f1z9 zn)wHGUU41`N%q<@r!Srrt%G7I?~&Pb2G+D^KR^pbt6KFj>RuQo70J&@b`59X@B#)? zy7z)h>5@o~@quBVL)bZ>6test!or;IYBBLQl!y(IE+73Sf|(g9>nuc!o0u6xqVEX* z-3`$FNCTACCZOi*jp$PT%ZyWff7s!I?>)?#G!X-@R)L*165bi*@%GkY?yS_<^kbc3 zU`*;Mp{_kJG%;mg9isJ;(|A5%2zrcq3nxJkva2t|?vsZxVtP-EwQ+=0C5OC7S?pLm z<>Sa;F++Xy9o-FX^{XS;{WcaK*3B{Bb!7uO%$|hbZW|)fcp!F9sDrR`%Q5j(04f$Q zg2130>^bl&ckQ7m4Y5TzAMZ{K>TwB7@FnR zvl0ViQnH0;v*I*fkDrDC6C7Y8Q6pJpfF0Xb!MZrGW9k$>Z4#lf-D^Z+%PU*flJoPcU51j~?B2q+$hhxCnGw6f^aA~v# ze)3R|X5uppP0b|ab1^WR% zn=Y*1xI^e0nGtt%0hSn=kn}TwQQ{M{>v9*3OPk;W(+OKAx8%-Kz7A|^2-rE~3;MQ0 zwxZCBDayYHJ9WmK^oEU$@*AyBNl8h8o0}VY_3Fjjd_!_G5Sv5_H#xMnxBJ*@%gN5- z#4B5lW#m|&KhDX@gr1S9uCQxz5F4LH?iIk&#tsIg@=#`{AUT6{&IBS9v9W>lllCqv zJqekzTv=|wg!ojbwL)0f*us#ln9^ROjN?dL&-CU- z;66i{ff#<&Fh48|vNEzsN5X__2$ZrcFj8aai%DQq*@#JGm%<`q*vbKB#5*~}|5;hN z&@fsEq!zH{R(a4N%OdeWDl@Kb(NBn%&GyIZRD;!cmz;@_eR(w8{FgE@s8$v-IS6 z-AJ6s5O&rUTm@W^#Q0c}w*k{)cKA2|M@WeK0Ii7lfw;q>QKln-Scdr$I(qDstqysfh*_cCawypG4w;Ex)E*JP<9W$mUkuFxJ;)C|SA;M&JhPl30J2SIwp0EkaWs)!Z8=IF-hFL=EZDa z#8p7)e4Q+SSy7VL^S>G8$jMAWT9$$cMKct&$nS{duz8Y{DJxPZkYptgk(`hSr5dEJ zw&Ut*QWDVAv=Zirr=i8~%>dDmu*82J78%L=Qc{nLiT70UY^X?iGn9}3kTxeKHkHe( z`sQ}9G!jA~OGO6T9*}k&dd9G0_gLYPlXg)|>Q=5T)T&6iP{EWRq*3R{pq3heFBTjr ziE+gLS}cb2l}q^ z%kWV3XbG0tL#rBsYl{so#(UHpBDaTfDt*hR%STJA!9|!*PGoD<8_=kaC#q*1xmL(xH>d&`TPYe%3TJF!Z z(h22T!q)wnh1Np^k|RSA^Qq;(iVE+8f}!}6vZl(2Ls(2EZ=(F@ux|*dAg6r9`|K)g zxfaNqwAjC7B#yeL@#a*loVFC9@$WHj#tNkHw(NC#7R|=%INgdmxl!I&JZB1~Oqqho z^Hv~~zc4HG9_Ft(sWbdVZfu>4qp#w5)4xRudRA$N*M;iZ9L#Rp47=TR>vw+%v?(u9 ztx6}v^5);;`Q~vLv-=fq%IE6lIXLNFcr9tlm*e=NU+^G`Up`P7jo)U^L;zn56md`S z%fb`L4!es*TQ2D=37T|&{Px=hZoOZYgy&~4e)44eI%xuCY&lO#i4MPu>#+8M4{!P_ zKtYvyg2MregAM^YJ!Dmww6w56oJy^G^pTKIP@%MOb<9-(Q+_4ypSuMHgHy zREw>>n`6SI54`ycz(k^L#TxMZld=|mZZ6tPyvUpKd3JCi)?E+fO_U!6b{R@4$SEH& z7er(B+M_yy@&hhx+mCfed4VYR!1hxQNjEMFJGLG|esjs-^8Q^2$`k{#8)#8$GRpND zkA({sVNi7~y0z|$5TZuZ37*(r#=pFb zOI}G(e0YWZXV@h=b!f9Auzlw#PIw1inu89b?qJlSg_u8o7Ahy5MfL70xa*>xoW$`5 zVchXwgQPpVma*VpPJgi;3=Q=^X#hkpApeQ}ER+5}5s4+xmwvLW#wQpU89^fc)DuE( zbr<26^co#Ha-p8B?+V|LX>>7lI0vy}A4KW2??A<@P7w&QF zh=&il)E)w}79&V|un=Qf+hB0Z_ION0s9shucJ90M$s3wKhuzrbOT0H>^P6754LQh@ zB>MW$*ZYEbO(254p#eV2<^>Q-Noh1Fu+bh5>r*P-emv+1Ii(OKn)iqC+v|uS$60<4 zVAo|d?7VMsqiCr&PNHas;V5G*fz-eR`3pUXU}|ClGyPm_?LQb!OLn1ewX(3VG)K+u z^Dw)XFNQ5}mFYd*c|?Z_^n= zdiF%~_DhM43`6R5#N64#(Wz4_^ccE{-?fv$k;Nm?qJ0O{YCZ&>sk-~aFDyc%wjD8S z;0(Oak$zSYvL954_1QIwgV3*O3#_~x0>r&QpI%+jxnoQ8pM8wG&TH2w44A(O69*5& z@i&h!v`JUYn>7rbI<`X3VVn64el$3=Xarhz=zuychQd3WSV=_ey8oY{P4L2q-Yw9n z`*7^O7fRyN3^{=((QV9Zte7zrbGF<=nk)@!aV!QmYzOxwU6Um9KZmv*XLHAg7Y;`& z_E{~5!-suV)?2jhHWUXoPDj5{yGeuUhoSXbpc{$XhL!5z`kxKcQ_!+!Uj*H{!5zPP z;Eg_m2g3h>Zo{j`51ydk=)TY+9V8=my=5LfGgGb{7?NE0+w8-bd2Ju6Sy;lNXmJc$ zdJ1LV&c%i|*)TIPhJo~VI$bmcJqDI+PxD}y9`lB7F*Qz7hwC#jd{OJC+$=$Jf$5ym!Jq9-( zA3>9rxIt5^3o4rsQAz4eQ`7u3Wy^typ%{1Pj)ZC;5#o(2aqU5c789^*fD*k2 zZ%3|yIgCk%@OP?2o-j;l*AZQMbVJh`^>HF78%$Or;xlw_irf!QL(Nv5FsMf#G;A=1 z>om+H?Zb@OW6`-Y$#2~kA#Y;TjV)8rl+^tVTlU7?P~DJp;*;HI-Ju=&_ZtiMR57WZ z3;Tr4qarn54TsN_ta&WJ$@+GoxOu! zyY<3M)(@SCA9^f7GUpm_ZPOIa4-JSP?uWCvQ%u7CJE50FVfNtWXxnuNR-bvx#icss zAvzA2h<&RjV8X(4NL8dmAxOo{&K+?rRM!(y$38`?hQqiw4%atMM$>j3$g}$3K_q)V z4t+az!0xRJ(7F3cWFr<+TDK>0+Z|1+*TvCyU+|R}<*!4s0~O>y9U7!2Cn6ys0STmm zE3_e)WfjykN`wbd;2#1!VK-tUY?0xZy4bD?JL+iy$SqZ>bCdyeR&IpO&8+o)w^&A+=i3hsdzBACC+F`rFY{x z-fXRjF}-IXKJ*UiPq=|&x31yfv4yZuq~Oy{V+CS87-YZ0*v{inYTRbb?qZ3KZO3BB z`b)TS?H(G&Z^fc(kr1T6#|_V9tUq!P18S9q=i{p|YOxeouib@>-&UORO~<`it#Dq@ z5BIKL$E!_MF|6~iL=YK6^qCM*U`o$Uuo-v+S1%kuHy2|lwE}3eSGw096jG41AZTdRI3Cu_*(i?tCThu7YIrWi_ zt(Hz|ejl**HQh0Lf z0=CZS1d&{~*FZi3=ouIw@x?{d9e5aP-0q^a;v(uyeTs*7ui^Hs{dhj7Cti|PKP~7b zZl{&S%{#l%s7Njz-@lEvi>~565h!PgAK2YRXY?HimoX%76F>aw?2e(UAHsl$u+PZx zL9>q2Fn#weoIbS!rPZm>ibTlz;D;-uhq>?6A@r(gk7sx9LF`Z$j-f|zfqO+K!{(hY z(SA@B%<0k>uH%k!&ze;F6-KOi0zGvK?!OMexOGRcbWBln?=%||F5V?^dj$uU_k>=7 zQQe;x2I;9uy7nL`nOg@xpAu+QNgr>*HITo13U%LAXjjP}9+9M6Jh%uP7JfoXZ^!D08WY=hmND|%+?`z`W&Fgq}tS@Hw z8$-JBQUpD{f!wMSapl5n9O+vJp{KOgEe9NMu4ixw@y zitR^`QfT>kV+`-)fSdRH@cMoj>Q}ZzJ=ZGm_6owSP*ZemT7+mwB@|L8jF>tN(|(;o z#K=mtt|~&ViXj#3=b}4rJL0^*zmE{@yLQ0E`9rXI-+pX+CPgU;$(}+Yl1T%8`|Ncz z9zKq{($u*c>}=RZT?@vzELzvn?RMy7FF{mjI1XL+g@rf*hxYEnaj!IFg?Zt|(Zg`) z^BZ(m8pFcMc(&PtO8?H9&Ku}TOJcX*y$lEa?yYCBs@BCfwMb(BNQ|G*TA;3p0E^! z!lH@Skq#UG+!)Uya-DcF2LsV&v{E8 z>qcl?EEdmV;}GdBN3EK5Q7T7{xI}LRimRg@R}7ReDb)zS&LW+~slQ^zFTbF4ksN49 zhl(u+pQ6kEe^v%qiV*>1j_ISPVE>+-c$`{}+p1n9(T6ZI3PbU+Usy##?g3imt}5SrOyaObAnUFnzdV&~@+x5^{5}%6L(RB+4%otZ4+qQZF>2L5#QVXNY#p9G$CbIo5a?g58p7rLr zJ9k%^dYxd)z4b4KmKBUJb<8wUR(9Y;mJ4ik`*;1^Fxfb_e_F&nDU5IAiuoa+3 z|K@md{}CQu^G55&rBSb19e8^NJ+!K@bzyQxKokzt%Q@G9IgbtNasyM07 z$+6bFINH^##NA)Q-UQL%vAB8d9;DI~9NE7QM{fl{5gUj*M|LB<`Y))%?IooLYX>Xh zt%4;%0I5WP6I0saSaM73pV$ycyiYnBDx`XxC3)-+{L+DH{UA8n8zCw@1~;y`L0>-whgm<|4T3DBKi38+BgkMbXY&LRH^5f{O)3)W%h&Yjr2a0-fjGGNtd zKnHkiUx#Cfu4rry)Tmw-&+i^ZkhCnCu$vW@sj(EM64H3;o1(Fc zAs#&{JU{l~y@#k*w*kaLQf2mp35Hv!vxsYy8y8Ct-`$PBi&#b8sy4q`?L z1FP~Vsg1(BNS#Z0+v$^IzQy( ziQfuJ9~L2Lh;lher6YgpE(29=;SKAQGEyf^TL{VJ z^|*ZMI_eIYOoU7_iBkhzc-d$5UWEHcryxfrC*I=yNaA+gy*D^IZvdQ(VlkvcQ#_-^ zfaE6=jGVCoyGVPmb>%#i%%6qDQM*+KM4jD>O##KxqYO~GN;QPJAH~yf0b07SJsJ)9 zPY-q_98lE84i+W`+zzg4(wVATw=7;hc&BrS=jHwDC|0Qj%nTTkx&m$@*6-mucq2TX z96*bz<#26w2Mj+M08>N$+XGVPviEYZ`B-;E(pXE%mo6V_$u;bTd|4S8DDGT^G>e zk48pTfjq`izz^)s&N@G2qD0v$s8*#S@k0ZgczPc-t<@k^!DpzL+>dcm@H+~Ibb1S- zQ7MRGZ;Sq>-ni)g6wjCr=uy@H$;qiGQH~8S`>cjI`HVcPn40sGg7;>%Q9I%OU=NyA zDTDLV+F{gw-S;w-ZwpaOLmD&L045&{vNa?;oq zsDhx#$wpSL6f+L)Mev+~IP@|Ea-{}gZd*_Kx8sE9>O*58eVAU z%4Nur6vOn@KiFXUsD|)) z9tbDS4^ENV4sgbsCWASZP> z<h7)I~c z;`rf7kSa4F%SuBmqeePM0{lHOg0QGq`goMt0D~)M!#`1inj}A$E&}+5gpf?a)ASMHK1`kJ72V+v_X}Uqg9PajS{Qj0y6@!^h9@ z!0j$xy_KVJiz?h}M+hXSQY06fckai%>-S;XZ4nlBserVkcvzONkESiU!#v<7_FcIJ zjfEXT!!j{$Ob;Z*CZR$5max(nAUlOzTcHWs^&SnIglky4=M3C#UqgmveROQo0ks6d z*na3F0`S`AR4T4OXe@WRpuA{^f`2^aQl#HFh@ar;#i z>bGeJYbFgEhuUc9Y(?%nC4RVpOzS3SUDFQn z3At$9p()qV(IG|47FBU+?OI$8PDji7)nH$t7OL3^i7>K3iyFEuv#HV)mF$dA z%+UrRVa2fQxAvSnWttB`k=RSzv+m!yfo$$swunsu+Bd6B;#P`EmNIPIwjcLzK0t{+ zOR=P<3+L{Cors7Cn3|fx%8HHauZw|&B@&5%>@{*6H)?2LZ;$W*0ftQI0~S}Q z3GL9T0bgE8!<>+&M3WYcQL1`dv@e^94SUaE*KhrBMmPXL7iMvnsbm=l@_&n$PoCi3 z-Mfg&wnM$Dx+zaEv_X-SSJ=4sH16K;M4uHq(6*EX5@O;}rBx?%=-mZDdp6>7KrBic zr@>QE72|q3BPPWVUE0(j*;s?*gfvuZ-4eLkdEra58a3#JXt?nVEyn8WgE0dd2O9zMsz2lw#k zaU!WlYa#E2ZJFX0IJA2wZeG6)Rr$f#Fs>=GNP8eIQ46hFbbxc}8|*lH1sO*6i1rW1 z$jJkc6`z1AEn2|dM1-7-B+{|1g_a%r!i90ivMtB(kkpSKL>1AgbxX7=&0yE|19+|| zj(*h~Nx!2R><#iqq_dI}U|y*nYE`X`ZYAQe;6gNZY+8s{XSd?i#T&Tw)E^a_v`1+p z(n&COM$?LH8D>cNOGP!_5AyUR=sVR$t4{q;Uh^8uw;scTyVnsTt&R@$$|5l?m4vw+ zEIuxzB0}>{P4IZ_3S97yLH&AlVeM1}jVhZXDaROX>g%TC$kG#GSf&B$m$ig(DJMjE zsxWK8P*{?JY*W1x%Bo&r`L^SDaOXPW3~Hc#eP<*jWN?ECY!IF8jj?~%F5J3t2g2&3 zv35e!0(HQTjgOBHoSmIHJ@#MY;cI^grtdh$Ea=+~*#&xFlz$iYwUxQKIgE_*B<$y; zq@=*j%?-VJ_2O;5bK)+-uIVal+qW0ac2=lVS~pMnpOEE$1)HB`V_1h4czt9RZW|23 zuF2o)cKMXQ%7X_F;NalERiNK1;m60J`T;4PZW;z@(NZX5!%lelX9S)Yi)$9sG00Vg z?Nf)qcGfeDtM&P^Xp|q9jT<*&>eQ*c={rKv zR$h3C5xx2#=-OKBiL8#(%lq?ZDU?6v#EBDV-@ZMk$Np<9+Z=;{{-vG?IC-8 z6g&2wL+yE2sTikxKj>G*vkRLL_TV(GJ@JC_|1nEKV&#P5+C=QzvlBkT<~T{kIOPX{ zj*x!^e##MY3g!RFk1#?`q5PYCw`zaxz!F4%3jxF*?-dYt^!{|yfd7Sv+@I&C&$nRCM<8I3tIXw=P!fvuApU|| zr&B1D?+q2Q^HvYxxv^_GZU)Pc6Lts7cUFWkZHn5dTLK=rq# zK`@Y$w8&cZfn1C=5Nxp`}PFlxwh=rUa2ivO1a6-)Gy5%mtYZr{P(JGb%lbpTYt zzbndFF|LI7D^FyrMMOj^@#e`(q{`WiX823~1|mHM5pQ4N?%lhbpC0*qfT8~Ht!^TO zfl(TEuh@cEg%~Lz?(hstp`x5Zp>TL?=m!&%>UfouY`t|<+fCOsjJpLZ?(Xgyg1c)A zL5h^(?(XgmL0Yu9)8g(FC=~Zn+#TLr_jBFv`>geS|7ER7CX<=W`JJ=RKKpdTE$nD_ zo->6+wU%2id2hoy=0?Jmux1sx-7R!w^CeOi6cuNq`qTy@T1v>=kceNrtgG)=@4vGP-wDB;Ox5igsY+*g?4px<2N_%=S zNdc9ugCDbXCO*`o@&8PO zfU6$vKOK$A7ORF=dZoT{Dqr$R9*cW*YaHxvY!3CF(0yx;YQHBnieKqpdF5}xtPW52 zbkE;Yd21|R^IJ8IqaEu;?IhWd)GMqeO7xVBRULNdt1G8HCXb<|J;wCgaWS(j#TJjo z*Q%gkoEqHCGQLe*5y(MtTAz5mUShXXwQTd*6`N~{;NsWY9<4!ENU<$qTwruipt7o^ z54^e-?zGTfe?dZeL~JP{kfPDuxmZq(n!%T;(2@msJy3bPzY2-Em#tw2x#*3%?9ahBnYFnQ3Yv>8yRc z@St)}rYZ8PMwAi%@G+c8wS}DRKFL;^lp5Y zS`4?fbqb4p2D58JL`O#l%qLIG7FGF zrgmIf2jg_No?oNM*_*(%Vh6D?6Gk5rqg)5Ta~2Y<$&x8`S-ouTC6cX2&@)VsN(3h> z=%(JM1T?he@Q_P5ZuF%32Wap)R>+$8(O5ETdcFLHr%Z95qi5vDsxah1c=Yk}`xZ6- zQ!e5$ukG;S$lR@ZfTLf2M3w$RX*+7*| z0dkhA;lF7zas0(t4{Kz|*b|qquqctXG@AQjL?wEEj+Txmv=vdSAMXDCN>Aq>nq?#woLF>@gbOl8Y4bVfz+f;)iU#fpKp37FaMVtA>_b`c^!5?L}zNr z@sX#=9qgGy%akJdMITg|XBmrN$?CFoaD(M+*g;1A=Y{aJ;4DdxDuz~URJ_1G!0T<+ zbe4ME>*_bTCLL#^*bg5hv=tt%i4A*VWGGdIbN*3j)qvN>*^V>-d11||h zseKseOaIK$ChryjIp{Jsl2L5khc*+~@&_ubop|d&? zZ@Rsy^V#~7n2RTic(lzcVthv>Yb1sm$guu|_vZ8C?LGqal1>Y`{^E{s>!Q&9PU%6p zuJP+zHkEa&g8qQn#+Im!pdXUaJX_@D-gpVL8F9H?b{y~5we!gO@ zRk5rl5o9VjCn_FCYt2DR9qERlKu<#_DaRU=Uc&mfLr6-w01|W4ms}$6bib>(+UbGl z`Q4llCjLXO~zBQ4d=mjNfJ3e*K(CC{*M&osEjtt=q zkcEr?lFbsYBqqYF;A{}%@|%ZKtCRa+8jof1Zs&HbbE(;%{uD9H!tygI#)kkH&(khh zr5sMVyT9@Mf|TY@DfL-Re;L|Y(eXs@h9EzGIX~^Yvt`|p^32<@oi1ZkO|K7U!^h5g z{}C9mq{N{}4iUVo-DYT)n#Nb`C3pxzrM>|_isr8cx(Hf8d81dH(eV@FlI)WlcPzu4zhwCT_xqedm zEM_sQ7G!N8DDBdfvb#ckzbSOaFx^`-T=zU7lO7w@gE<~f}#LCHXi&N-829$9r z&VX?o^VxdU>8?*eW#fh@nWB`u-5-0pU}LzN+TTeaN!pGMAVDWV`9UZ#vNq)6`i~f! z&|m_LwRylDp@Hu!tlG(Yscl!$`k&@n3zs&M?gSK)?a}r5ojX{w_7w%bGoN;q#Qgq5 z&{hQwev3RCZI&dlHR!q#7&?^*CeeI%!L(I^@T5J@f}}b;6*3ziYG$!_Kh#fjek6py zGaPX@of|X`3u+sc;j)twJQh-(J9^fe5PyWj&Tt1tb7(sqR+1KLH9Gsb@IJR(kvW*I zMJ%d*2}-}l_E70NN0h%f4<>C|qDUhxIoDHs}X`-;)%@=TD3z=1)BjAE-XYVcoo z_ScTGR=;tGsCI|$ZuT?TY7=x$Z}cp`SDvvN@R_17OjYKxyKoQ-aKqer!XD5T__198 z)~J;h^0^`8FbPEPkW-|-=_z;K+4X1>_lkLH^(awo4bQttH>}a9II~~%_d-U0a_{XB zJRFH{OJGT_-0EqT7izQsbi~bxXQoS<&ndi7nA}mGTYkk8Zh(6Wob54D{3q z_tXiB<8hV(uRJlr4+ zO06seiHX3yyRCj?22s)62i}y_)NEessdEOj@a_HmAp~UPt1p4saX24`6HX?kPFAu? z?z+6j{ia^Daw{ZuScGH1EWZh?)sSt4o)ABe@t~i6<*G=`FC$`#sRb|*mO zX9a3=wwm(k9}Fe+p)wWSq3Ht_+A!K3`k#i4_vD2WLe0i~xeZxrWf)ogvlxvXfvWpO zwHb}#LUm%imkLy#CP_s*B}CGPy~QmgPSUm$gV>LflH1zgAZ9Ih)#d)jcAF z?vYDgy}-g_^6!`sUycl$OSaq;)&%-%Zzoc^xf}(yImNW&1fSuRiS=Q3{w(LOSj8y6 zk)=$Val=Ww{fTP-j4=}^Qh3<%m&1Cvcw%8t+NDQkf44n$A}=99rH0wQ>xVVV-%c*g zRm1J>(dO)r;~#jb4;Xl@I=}6H*3NFBSIyQ|Y@bNtDa)GVr*O$+CSo+O%jq$CUjFl>+!tUo^Qtp-+G$)Ugus;} zPLS8`@~KCMzZLAqo0<*LJ=QAu?Vh6ZdJ-HV$abB8BC8vu(KlJh~Q_Kag@kWq3F- zV5Bmf|6|o~a-1M8U{6y;tA`$nxKZbk_tSB+=f`sCEAFb;ZVnuKF zUht*WpzVRJV&kn>ic_>{%0@v@y%ZTX`R2j@ql?PKP?=qk;Y~vwhdD~3bs|`|gXWru zz#fxli(sq=QjXKAe%70vo0y!H0b8?#uT@XM7E2gf0l_zSVY8$JzIs-y!A+IfYfeqU zP?|STC%Vc9RpS0$;6NqqoMSq&AAg{xgl*T4EzLp!h5Kyx^vc^Te8oGYmkb{$L#$lN zEs=X6#2M<6&Qigqk$9%LR1uFxSk|lsfOQZtO~}j+G+=K!Ze@j?Vf<(sajuT3LHtHN zvkK?|o+i-PM!eWMZmw*+$Sr%$iS70f*C2W+KmrAGJcn9>1M^#omjmgigf~r79wUC8 zA^JM=2Fx$7KA5ym3m}Je`IOxc5CaTZEtI~6LCrNa>lzuD_$8FZ=lx`g0&w|kdCn9S zbLbdQ`1#s+Yvz9L&(C6hqXqZDEdLKt7${Q95%F%ndWqQcPA<+>h4ismUEFFD2w1im zWqYIPM8--sj-U$qjntwWV z1Zq}+RrBeki;>AFe!|25`Zs3mo!;m0QF;YMUIk8v==4&&BniYXOw9X>sV z4wXOQX|)tpSW;TLpktp#Ep=!ACkc`om<+v+IK0<=VbGp2m7^&8?QiRKVxg`;OlEY< z*$RJGokJdU;nA~Xa|75tH$yxtl6l#tC*zbMqw@5Q3nSr&@l&FgL}fN-IybWbkC(OE5@60FrxhQ&KdOATK8zxShUw8v|3f zqeb$cw_PCvpx9Q&9Su=OYa=<(WkXTWM;g6l&Y7t(5`CIdCl*7JmcRCNDb)i*$rafg zQou+aE-Kq1jf%@cblNofy-WYNjNFi_&@}jzM2oHuu097l0+v8=Q1_Cmo2oWQdAxUY z6u>a5I70JPr!+u=#m#iD;jo{>2@-z;m4#s)BXM0URhgGAJrFHU4NJ;7zbTVb`P*Wn zFdo;_-~eoL{0%z^mESKd2|V#7Py!RlDcg1Tx$l~W%-TV$Kf=Ep3t8HPQywHngGzZA z320?lMAD5gYm7ooQhHF&{Li14Nu$P^Wka`#mm2KJOWh;Er=?&f2YPD6B$IL7Td2So zUnxvQw5T2X(GMIWT@FFy{O<)X^@t@n1FUdzq2)!bUa!9?_d4PRvljQLr&DCA)eFjI zrIcAbqYdIsS}ZRKM9_^Zc+u!bt?7(}?)XbJEoQ1^$?sEQw*JO~+-wZ9@y`RFQZb-+ zT9>;{`e+ff)Z!2;mrmxbOul@YiDRyX+Ct1(ch_p?ClrE>Qnp~JMANweqZ#L;CmE<78jxCCs?somqUd}-f)BlTB z!+HkPXG#llHWag~?N01@=jn8}3py?oA!#tTy67F(_9Wl+!leimNmp{YaV)r7+Bao= ze(t}m{$pwHM-cT+ki+Z^Bp+8;m(jF>YZJ{lVNaHnPI7s%(>Ouad`j!P&D2>7hfW%B zyVSQx!Ec-}RMB|ge6cFqb&c7xi&a*XBv0*_;j5RBQe}$nV*Zn5-q?kJ_P37Q&m60^ zV0h4#(k+=G(}rD5G- zXOz^y?G)knFHhMUo(xK4ZNA<0E&~9LsE4TMFxr&YS@yfaY%jS1-|sP2!m}xq4s(RI zuF1*Zm|xP;ZT=6qU)sFP`u-ZPKAfSWR?a(Av!bj1?XT7l80`ygl=$Wg*r zLhIYppSx|quaf$`QkO|7du^QPS-xo&F_Pk+l#UZsCCE`S(YcWIHV=cPB1Cgfp+~1E zv!X=McA25CW;j~OVE)#q`cs?MjMolZ;$CcU!B=#%^+2#qcC<*|A&G>je}IaZ@}Bv? za9Oy+_8a1}0#Jqz8~!_u0F(7uT#dEb*7hKJ+sz2xyG+cW0j_tN&LX|zI9uZ}>ml^i z+kG6X%>1~%U)+Eh#apTgUL&d6WR-pcRn$;D9*{Y121vEH1PWjyc| z%yo%t#>;jF(!Y)nD74cfX%~k8QmGGcW7rYwv^Gt~(t_)C72VDxam0-UgTGfq;k$B= zrL)H$HxZS7-AiJ#M3eESZ`f^r&U4T*7CfT;35}!;u;*K_KgEI0Z{n9)57^eNcN4ci zMy$&Ze=CVH{_1>{k6cwPl-sdVrfW;-2r6RDe)L>z#Bk#)7twjw6$$v#3fpY zwmx`u)r6+$A#S`s12#PdMH#pgux6(Ex}V}T-MBLs8}%JB-a`Ad&1ukfLziHmA8$Ck z3NB*2&l--iQymI<1Q4~_ASWCbCeof6n~l!I2uXCZMzBjpH$Gv(EObCj?-sKJXHc)c zObjpc=5oDZgt|9&Q1i0pe%djdsJxT%=2d6g@W=NoIH;+WnbEg+sLL>Dd%>Tw?+#Y_ z9#I@qL*04|S*=FMm_AHsehKK`!b7fqz1F6&l%+dMt=qlaD`fw5+>n$pWgs>J;Qhij zd{H7_=RGK9|Kl_vn^b>ud9FeT6!tg<|1Mctqa6 zUAP%oO~ZN2u?l_;1I4V523MaLEiFH$cEp`UB{@|oX3tn6KumKzmfY_#)Hb5zBP;sB zdTr&}uQYF7U)632iYZEZzBhJWu%!e?hebJwe{ws~CjNTcHJAqN?6r}LViQcFkNvrC z1)rO!8Gxipj97mlZ2to<*hOF{N^#L_;2BZl`+8)5CUBnbm+rXo z@KN|H1t=3JRF9nlChbdqWyb|KvqA3LYz|CAPv;dO&;CCa)beLvKg_sRW000SUqE@@ zj!d!bz#K9J)%r`28C{>GT4>DF?K1(J5rXei&rlhf3i`2KAu(Q`u$_8-KO)4#_T>IESwW*~3YgVS-X?<&w#~96j{yNEAgqtyt~~sg8TX^n`Br z#G*@mA{ZiT%U5}V;jYIPvW@8E-XiOf#|hWxYNpW#`^k4+_DvaJlSCTkRg%J_4Wi7M zz&?-1D^d~`z-n+lyXAHG8`)EhVYJAsdhBxk_m;LaN2KUmDl-rL;HJ$Ww*QsacfYWE zj5*l~161>D600$i65B(bKdq-2d6O^)K9d@Gt1j+F;%pii{oj6A6*2vdVc3fv(6-uq zFGW+S;~{5X$BEFgXZ8t5Bk=_9AZaBzgWppj$D77lITYHNn9SNNl|Cn%RPZU`lD;M? z26cGN8kVbxB@!(G16OyE$=VS(Z;pGq?i#t+gR7c5AB>OD=l2XgHG$Q8gtPQR0j7L# zPOHz@yh)W;pnc^q>L9EXJy4~;ck!Fd7jaG9=$BkW&>hF$`>dcht{8NNjFf&%gg_Ui z0ddnr@bND3Dr4bd;aZ~?7lDc1#%21HyRpwb#&;i9TI@17caO7+F7B(95U2QIBChY` z9qcY#k;=)JIz14Tv=MGu&1J+9zt_bGCb1HLh5s{_@1hY!q-f$sazYRV%e-SS?z0YO z;9X>ticSyYqpJ=JLog3J+L_gmlk-fO>c=$Ef(M5F4oi0(&(Yi@SrN($Sg&i2n6|Hp z5ubB=5bO}V9(pV62#9QUwjTImuIoSJxZ7}f5Y_bO3zuyXP|4`NL&jxBL%5HCfUNZE zAefhaF;R5HMD^Tu0yZ#OIyeve%+GT!nh-nPa$W+a_d{xeJd>#py`-Fe=0#^Zh&H1!i_sDXn}B_nYj%NDO8#@@H<`LTKcpwRt6hmp;;rD$Th`kc?XY zgWqU(^6UZo(sZNZ>aErNhZKr9_aXcK_dYZEN@9-}C)m5kL{fDoFHGMY6iY~yCG~AO zf$%WLQw_uSj~*4$u=N(mh07Jp$DiIsDX1rFx_*Zi0+%J_y|Zyuq$dl(O|YU~0GS;{ zbP{nn!X1N3JS*8ZB5@xGVqS=J28ew6y0>qJ z8Wp(QxtxGJ2Vdt>MLNWh11-K0xN~_plR|_hSneRk2Z6@>w{B8$?WP(aLZr{_-wgP^ zy-50&J+>+U8%b*F?xNp~5nbwqRq^I-I)%Ro2{vIkUbzBWr`{gBmS&J#;YlE6?u6z% zH(ahSJVJzjoC28>RP9h&84jF_ke>pin0(Sjh zAyjXFQK$gr7w3<*2=st0wvQTR&W`gewm~MZ1i!j5JMnDo?s>&f_~p7i(joWASHnO?L2&)zGXn4#D6d|3uY0Ve3#^!gb{?IRc;A5DKKpPNRY zUDhTV6(nTc>)12_@!efQ6no<6DFs{Tu|cQmfW4yMbH+T zRBU>{Sp<4h2Kp&3(Nm;*Q#$>ZC&KiGdkkc98wvi8CIgf@@}TEe2<4RgSEKq7f^FUkdngvY%nnV z`KcR)t^n_+>zkh=-fd3Y^CuU}c7=?<_(3+lDAivl)sO0CF1jcxBhqdzSTsED(O-0# z064kvFezVM(9k|M$L!YIBczzBEWWLKU6krG=t(N|l3W_g2ILl$1+SraJ@n&ah`)1Gd_3gWh4u?gFXwH{Y*j zrc|O`o1S7(7LPwuJ{F%;Amleog$hCp%`OFVUK(r`&R?nCR!CuA*?D+p?2?gFymrn~ zl7kn~#gZmSYfbzjFA{mZe`eCsasW2~H%q%ed@`v*VkD3ApR|4ICQs@S%jA5@>azI~1Cq5ZaT5MoN0qQF>VEvxP3!7Z(S zd89FgB8N*&B1-H+s_o*dOSp=5BPy-aZE+{7$|6Fm|8mz7`t{j;Y0v)p=7u_X_cP+N z@G)+}*4CDjyZhc}rnJJ`|8gP6Vp^dghr@>-e$h~Ypo=e@QNZX>370$~BZ~MjBWN!G z^fd0-&>tX-cZ|G$%1XCakpXfGEmZHSoELZjwX}^zGrU2e+@e!od)MAwcoFAfZWtgQ zpTwCZF(yT2d7@|bk18qgwV<_z@|YRV!{E|Pi^0u-ZNMm`c&L^5foIBfy*xtc}~BnyDi z4pCsI_@UgBdY7$0sHhoZYAMDnfOzoSn3R+iKU~VmRs8|5D=8Z)4@;b6m)5pPD>Jwq zk;G`dx!bAJ6{}xd{hj)Hgg+6U7c!c>)nJNb31q(bib4%xR>&YKiUPqHDlvTciVjgy z8FIMe%UU6(;?EBzP7QTEo7<#J4X0|yA*iN9L5&&yFzuF={E4T5D2)>wr?oi5B-2+$ zy(Kaht{lBRhykXuJdYUwe^E)ug|&^M-}2X?vM8V*OVXk?k} zWI{K68#5}GA{W;%cnt;@C$i9~)J7R+FAq%i^f@pLm2Os>GT`#2M~%((jcTRThDPsK zu%&I)SE95uHTA9IIVS0qp)K+;hkVpM(NL_6SW*ar9Bn{kx=FG$SI{uW42r*2p=$BL zrSZMIoM_Y{kIuAI1I7r`i=vXFo(zd&>P}=uI3BGmoX2TU)TW>UgO}RtQi->X>*F+sEmd0tSJ;>M(`Tqnc{cau@&9abmGU(MN_C>mUxA1l!?r zFNRVC#$y6*ISV4dRfTXGV{J~O3T@Yosk7e7TnD#fJhArZQW=h5tXNtfB*}jt=j@#%j-fbw@D%c`;eV8U zrX!VtCtEixX7@Czy@;^AgN45ze+z~ygFArMf2aA1sdXjD2c-lj>mV?T8fH@A19S@r zW6Lxjvo_j@{$@1yF2xuf`(z;{ma8bJVruk{V(dKW%1+a)vWuwH%#4$u&>KC-Mqym7 zEN?;_MQ}2MReY6&a1ZD~7s@w?A^K*oux*+2V>}Yat8lR z7_4h(msng=AGk24F8|#H=abGad%&W{g~J>EwVDgWN5DV)+vB#}^f$^dCvyL{kIZhK z0{xq6^vS1BuxAZKe~gXIJ!n&IfTf$06rr>;uni1s3mrlj*ZIIFM(SG|S)^8l_D8NyqFL2hi0CCbZ{Di<#~RB{ z<|Ro}-W>{ozL!~~HDQQ$T3zd0ydJNxp@Ba){uL+Ej+X{l@{QQn^sB|MD!x2Q8*J_i zV1^dDD?C8Zea|-(&E-E%Lx8{lu3Hs2RQl#*rnLbP;L{}@Jj-Ji7gt}}j0fe##M9?1 z_oka98B67(g~OFH?o!E656_|ZX8DMqwDMqREUu%FBI!#R+0cCck%rnZUp`p9nx2k^%lEEQ3X+O($$RtF)?05b5auMwvN|6l{a!73%HHUi9Z>zrg@*zs&w-h$G!sXQD zLtec^a&m%>^wQExx$bCloSZVKi(JjEsi)vm@1M?7M4$KSNVK>Cexf}cMbx&v#ROaf zrbYue7iT(Qg%dK{p>36-ue8^g+$}P~UBm|qaTYgk?7;#BCm3SL){_q%fAK7D|6IzlQ6R~AFFqnujF zP)QOGz8dD~x>5Dkmr0K-<*mH}W&f6e$+|R=Uwq8mqR?eYyc%~X9e?}d7kvF;-JyNy z^cj*vgBQKg&Y}_}dUOOaYX=Fi`{P`Ud-7?yM};Gl^6j&whLZ@HQch1V zFl-Z)FQzx*3ZeUbs+~Rh82qb~$EN|>*dl$Hy;^BbQ1$PGVO<|4#aWI zs#5BCJEXG*U1dLo16oIf%>3D2ci4HQ)tEF3wXL-m3B@o#Bgnr}niMWE*H^Fh{gi$_|1D{m!6$2!b6?T_#7ZdLKH@~G* zUtkWTRc#r#?}#(xp~xZ)aA}U!Kl{*S6nG=6=V}q{P|3CmV0pa-wfT#}36?B~^m1_b z&Q#()`$&+c^R3=jfT266kw&m)9Z{Q;A-@Bdlhv%wg^vEg(2W=IH6 zH%g?`$A4pq!ZOd6IOJnwqwpK$UI8}+W$vj|ezsg%aY-&&h~ByB;60(BxPm%MPt5yT z?l+{1s|9=&N)tlak$7{C5aK_{TnBqddT~|JZe)@(1YpmX`r{AydOsBQ^(>h0nHXrv zSwC3OoXXH7gpZhI=f_NS!qvU1A;_Iz$wqpVX-=-9SO-*v{1WuLIBG_z?jTM;A4MY4 z{~6}F=jx-w(>qB;42@<6DH7*Edbesbe?$Bq*%og`iAIw63==S+FK4zh}N3^q0l@E|h3sCKXruD~Z= zX2JaaIFwC4g)Ykqs4JW)nNy)j%SWGim0BMSTaAfdE;^1!%J3`bdl+W7#AQKNfn0%n z2M@jKpaSi5Gaprfeib025?VkWgZq&NL^leder*!Om7YQYL(~ffOli}VGzO$#=88htf7TaRvf$>V2+G;#|2asK>fZWX!@3#@AX*lBBQE?QN7S{mnu4tC-2XtZJ}> zXD7+3kY|Jum*(?0%}oz3X1vmTC-hWmF6K;0WyrHD0^C2-i(zG!JghV6tlm?^3r3XC zJ~T59yN{acUy}L=U~y+35B1=WC1Q6T-M$JEmrIRF4XU2arlbX{?Y8kh=+X{zkgi*d zzR->6>SSpLU^PVJ6uPrUv*Ph9WZNjeHdqxSGGp5lS9H*mF?R7hR57P@V;i4oNvl2B zj%wJ<+*z{aB*okWn-Z4#0Gn#TG0C4}%xsid`Pi((2JHEOydtkxmMPgfcP4X{c z+L}4X34Mo*%yq5l=65inpb56{BbgWrM^9t2W7|mi5@o8qB~@GFI9B$b(}UpWGOu++ zw7ubNZ%Zu3q3=Mea;W!lHzeBUsl=Q|ZkD*VX75~FOTNk|()-EB)~(7Sn2ttFW@WhIKht&1X%H?p7uX1bA`Sz;G<_WEfoqLZo%%;zXckm5$}0>BoSW|jcHT`87#J={rtho8uftwP4 zz!fr}hrA5gATmtCb$SO4CP^5_;=Q(mTvS$LW@u%>-sd+GyuXG;wupFiLo9VKvLcSk z5WkIT-xM^f6x_ASY%tEl3pv(pLuf%6#gx}a8meThRgG5?H!R`3uR9;IFoZAAnySs> zNIV|%)*>+ojLu@^5Jb-s^P7v+W5RXx`M&vlEIJ9cInA>2J}M5XC(3-`O)i;3bw}It z-5*&|nH!xqH~ciW{ES>}uRMmZm4r;Nn?@OG;m8Y94^wsD_2S7jk7oue>XceB#C*oK zo&kK=fEu5NinhOnsvX5rg-Q%vn031WXqLwf5x6cPCtvnomfAy*fMQppyNmggC92-E zv7_c!MifVoE)oGbMkozTWj<1mZ)4MV4EVtZ^AOzP1d}ao7 zP>j2Ndp0{dNW?|B6(b25gZ!3InSTpyJ=^IOj-*1Jh#$C zR47ofpBb~-E#&#bd&HN0A%cu|0N(}yjVa^ZMmV}(3kg8UrQRTv9b7*V({UiIaskBB|)#K zJe-2XNLg4E`uF?dNFZ?bss7hXVNHrl!h1y;?RYtmAJN69N9dQc>P67ZH~flZkPRP) zUG6&Bu(&(YnG3L)P5i9Sl-3O+BZyS|Y~O~TUL=Qz7beeA_h3lkh`vf>M0O=&0BuW| zKSBtY{ZN%gJ%!=k6Xx?!vO_yP?Ck1bEzq(J#cI!TUqMNvNiNRkwj_RU`%J=}a&KLo zqpSGegePsXi=K%l?0}aILA?{XiW-&f@PdKqUjf2x&n)n=QRQdHm(zM2#m|0qqM^`0 z@8NK1c_G61li%0^NDSi_yY&dimxd;H&92GCX7nRu;{5USicR#%Snm-Fl^DbV^tH=XP|VDr2WeBk9ES+8keT5>NJ4o;m`S; zI6$5FOpmFmfM{pU5>XRP(RvA@=!ZUV5CP}M5z?8+qEeVtZ zjkItd>H~ia1z-S9ZahHSKYWptL`XKhD1Bcspf=peHc32YNx}Kmnz|jM(w3xhG4+Z6@OK7ub4KOIP}V8T>Vm?c`&>DlMf46A7kAeV-Wl`i0Wz zk&j2(xp0M>k)SfilefWb1iw43Zms{-N?qFXkX66 zpheg}v6j&~f?hI#RSSKqt7LL=fntSh^z?`h4i0}7s@^%uJdmuSWq?I0EMNLug`7Ef z0R0N;JvVxdP~si-198+$dkU(6dy|~vcwmb++TPjK|0vz}EH7ubLi{inCDiD<@#zLr z1f)$-Dw0vOXxem3HAa?IwJnW^3=Y8{cGqf0Qw&^gf*sS?|CV4!U-FM=*>Ud~!6o>7 zlp5sl{zMl+&HV0IWas$Vg&wef3p9Q##O{=an z$erhF;kGi0fE6sz9a@3mM&mUh1`AU#uA;{MzD9};IcNksX@$YW@$3Me@AwJvEWru7 zDqyvNNVZJsVw0$$si7sY87%3a$`-85q)-j>05_FV;4!oTR*`L4eM_zQ-%Os}b(B3E zfCHEb*h;c5#NUAcRLm|i&%0Cy>l=Qd-8F?3`KJ`yAF7QUu0`~p*RHSQw7ao_h0xJ| z-B$duR-jDl)c(eA!6gJ=MOAc)3*IrsJTwHF?A($5Itm(u{Wx6Ty(aht=%2h-5*2KN9x zJ;MFT+(;g)F{zT-e|(8)RAXlbMn)M^(?V9k<7W}HJ?n^*qKNQth)#u8Q+$!eD}%kY zfRGSTm0r!GHv4UjLE9l6!7g+*nvtubzEI#SwV9_9)eMg`H}wk z(-kwzNHh)6@P{=d0JrVWhXp#NeS_-K2^)KqVp|0`0UUE-Aa-@yU_ zDEVKc>Yq5nj}_s62M<{P9LfKUG5#z*{NMc(4Eq#cj@*`%f?@g=?&TeGGOE_E(C%%gW1^FX2&8 z6X#Wz`=~AbN-0;c885z)KpiW1q%im+-WMk;XFNC1l8DU_9Li8-n!ICUpY;R&BF`V` zV^dv-0$YUbMor%2#@0(R1=EH-ee#}ZqHc{+$(aE5h()2rQv~ZhvDO)O@>-~l5tgI2 z*Ok1b4P&zT$^qjmfgcBDU+>k2uEP~q3pxM!e2;WN|MxuN9uSjd*pc1IH%F~nX*LgO zGbG1X_}heXEQkVz^WN@ON#Z`B_G{Duwm>*3$;psvk z=xpmEtKo>7jg7u*GBFN@hI+KrTwIDcA@oR{I(~`4^nHYT@ZJ^$AiC$I-#zn{Soloi zR})s3cS%wkGY(3(-Tu3jK8D3qD)DE2H8Pjbl-4(9Ky2GsN; z-}us9!hhCf^SXDYbAO0;)CJU-WW`fY?Kz)*SDR{hxG?<;GcZ8E_+3&NYRicH*^n~3 zWTM(W3>d$Pd&3}jcwgGEMiiM} z5bL_v{Qv{kkAz4V+V}jYUu$2Q-*$8_zuvhT%G?FQqGdG&ezrF>{?pu)Ar>jg)^jku zm~34&9OKNMTst>(4yNc2UqXCDEOu!fE#ESL8;q@+bOq~F_H9|~@Pt{01BY_MX#jLu z@cCQVeZ?=aV9T%M&mT}EFf*l?!bJ43R*?mv`h@##C30v!;2o#{9xd=D}2-3F=zZ2`v zfM2`uwn;NYQN(%@D*o+yWM#6lRw!8i=agBY*X!}Ak>$0g7D4XiL5B=>Wtj~J*`+;1 za_%D1`99h|farB%x;+X56PN?MbBJJv_rdiisz*wR3^)_`47q=yOyVQJ5p2KvCT4Gh zAGZ-EQoXC+r)-$@8(zv4*n1XVgmJ!0`M`10>NpnlALCYhS6(&2l{2#&sma#ju zBL(Gf!=pW$!xe05rpfR_g+&oX1H6TjV!NxSXMBhbOIT7A(b4ZUz{vMNH7WjjVhTU9 zka!?wql?$M^knXpqOUK7yV7shyG9zDC27gcJsu)}pm04EZqdpdeBMZus34i_IA8y{ zKzdt*zS(Ao>yKkEcQCH$=g9ab{D{O)$|UO4m7ZCMiKN3CCM-15-2Dx%9e}apBI9!7 zXt7ZL7DZ(etxZGkZY6fRP;=%z zfrr$-Zg;pD{G1^YxnkaUvAEp}XAwG=rvBSs3U0hCmyKxYw~^$UJQl(S>)<#ZkJg(R z+Y99;w_8m5Ik_r>Xlu=dpF)`6rXgWv!gAM+=rYu(nLTig4;46uu)j2`Xec@U4^`hB zUrEz-`^2_w+fF9tgfp>in-kl%GqG*kHcsrE*tvP$@4nyf-oHlu3CGoy;sBh zswZ1ogBe_=x@AyQOQwO{T<|%55pZUHsE2UaPQbt9$j}-%En8t$%jMb^DYiX&_i0Xq zPO||is?~b(ZubjCEzlV)v-vUc1Q63oQ>jicqDN)_*cAai>v>PDp1_V0R6HG-{C z6UG?LI~8bKspS6=DdFTHEOkNmlpTD(GiQvXwn(*7>k;&RaZz{E$=IzBRq@YCHQC(K zTwKRaktJ5pttI#Kq9ZzqugQmM!GZaK)Pr#S$~EcY0+lX|=nkiNTPq68B(ueU_?Gk( zl-&7(W~z|%X6jiTvPBupiCQ)TRJ%LVdN~rQRM-*wX`r$950_iHg?Tgw10%22#^$UCaJ%QG;DxZjuqI-9EAv6^FJQ6i!b#Q#ZiW5~wviixkh?2Hi zg_DYD{f@Zl2o~}Dw{*n^PC3U8Q2li&LOoVN-nIHR=HmJLe7B!(>sRsTqv6FN=tzQp zPVodliddf-Wnfk=`e&gQfQ5&xGYiL|f>Oi@#nEvj5@Z1kK_2hutL6xBD=~$VqiqzM2hN!9MDZy&96- z=_cll8D z;p(3fEg?p;zH>CA7&7hzCs7(;zI!EO=s_3(ZT0Z#%^9J+NDi$o?%b*m)`7$>l*7)K zQ2Xl}$fEs+&Bbt(O?J`$IL0QGDkQ*X{Xl^(W){KJTsni>_isSKM2q~R=4D``iM{~! zdno?$xa~OTdi$S`Wuw_VY_s>U9I2=zW+raL^{ByvU-VXqVSP?9j>jRk2*VR2u?}|t z6FH{zaF_+>Y>Zp=BGcqRH8I-9Ps2Ys0wD#<>!D#VZK2O*nGON>L!?Yoef?l{H<9uo z`~r}dtTRTNkExp<5M^Hz6rDaV_*~W6BQc-9>xy>pYmG8qzil6S;D6)>GNBM%1$zS3 zm>;N7Jb+kx>vn`8IqiW@N<=rWXY9mWPfwCg5Z{z@LtUAk6Ti%9WbYFTw0kolR>{K% zuvShRe+Ldvcg%i62%U(OpSd{)87HG))l&c)>3VadiY-)e=o(&v@oBLC{7oN%Pn*(% zX3~d2Zovc@CyjW{jIaGWWxe6aCmhfBq`WnPQ4|pb@(9`D_swKwP-Z?0bSEp6B&9+i z7gN|*7?jnU(F=`H=VPpx*dM&bV=N;;_|q&Gr-)$y)Gvw=Qf_K^pDc!FKKIpHnMQ8r z20TX0Y=5duDp5jvXdOtR0qGg&1LG0{*?skU0zd4vIkP#VQJ5^xOf#ZD-NHwdWJ_2O zrLT2Bw!KhR(N^LXw?H8lqB~a3q`<)q%OVNKz-{JLSWJ72M+@>!<$)!1^ zIb}{&ygXo_JQT5#DT$9Gfr+PJ4?N+E+ZcAd#z2vZRQHDWB>Wo%S5wapIpvFGNiU<3 zv$m%H@X6l^MIuVOxUilFc|E>3tD0Gj<{8SwJ{pdqjT+bu>dS;oL_ zMp)+VMVV1%pq%1?UAQ;Je}#vQUNb-r9Okd*Z((tvwrpHc3l@3rvq- z;JQ&`kz1T-4bdDW6=7oZ}T;=a7hMms20K8LlfuLn~@H z#8!luyw_PtgQZ|d4?XRqF!)J_S2D(ni;ZT6 zg(erUc@qq_719?t4|I^f>B`MZ>F(Q;%(NxJ9BJZEj4URRd~Erh46-w~`bUECEFHY5 zCa>3zCiR`o%rVV@=~*{AfPG;jr$nn?4oiwo;fXf4Lwnu+6~y}78wDg;sTM8?=O7r^}6GqjrN z^XETX;z5aBv}_1wLWbLySCe@Q65AC@BtDP4OEce6n(DzB=hlVe@&{BR{h{Zt2oc*B@6Q9W0*N84E;au0%k z)6p7eS$>!39NEC+dr4<;>7%L`rO6b`PkL=<7(?Tbu9y=`Dl zwjOqnLxOcJcKzhV$U^7gX_62TPYEUZo|pIgKRt}u7)VSJgU|XCF54m<9B}#w8mI?i zS(OdEB*>nOE2oC!3S9-#Tx~X(b=J{@5}vcZ6sPpc25bz#Bzm40x5eVN4D!^{!)2un zHIpD!@->i3j5;{wLSwSim0$J0NvN_LV?m=Wdqls$gf)RG5|zo#TceCMm*piUuuF)^ z&%Dl8*2L4_<@8SMX$A>fM{E>X5)RD_#D+2A)NMxJ5b$MNqZSChQKH-pg)P9A77;!P zAVJ_sT7y`YiW?(FKXD+dg=g(mz@R|pYd(IUL50avCheG&!{m@aOoO)BXbYQBb*NE% zZI6f>P*|FrO7_Vjt5Brw4O@H3$}L=?6`EdAJu1)pbs}f!7z;^y5>A24YB?$>mY2+q%)U+At|4{e3ZN2^1?R?iA`6QVLrANv58HUwtq;{O~|O-^D}X(C3~~j5fVO zk?9dMTP2=X3Y@%{ixaL1$erkfIqViAU7t*RuC=7I??{yA|++ieI}& zwCB?Ll;e>$IXhzsyy`u*9^lkzT~1O(G7rW2g{*81H@F;v9cBiJk|>+E;Rm-D3*tYe zauOSe(7aQwD&J6*UC}ilmKn!MfTYA836}=UZAJG7@nEQ+jJBWfWl7rU>DM`ODR4BI zsnEDhfW+Skw@Qh($D5|G?Z4mtaKbS;xuSCFg&}-r#)HNnx>9TA}}&g$tE6m+PQ#M>7MB7W<0h+K4YyN>s>UVY{;ZRZuxMcTc@3 za{@Oa^EhO@T%w{Ca#1G@=)NGr+&v!b)gc{*iZ(DPA7c0klJ$n#qJss4uK#3E_DK8% z%C3R^i$yM$J^;h7$_uV z6#BCGJqqqgxIknJDPwRLrDMd$b9G*idV@^ak2Xr3cn1qXR~>h7y_ywnZZ`(>gP5K3 zX$z@iY3sc|2H85yh5N*vH}^w#R#q%eQjj6BCx7N_wDf=WXmUSH5_H>L8_u0!+(an# z&NgD79u)WOAO5!95)~ulyB3}S!R-I8JaisBJBn^DEvP(xXfCLaAMhA8lmn*_=9gn| z@+ZA?#g)HuvQhCEMuL!YrjCfd-YNZ!2ghh`3VJIX^qyc1D|7^YFx%|<=JCZND#rto7xFv^o&A&t^6qGAXjN&8B%UhI zJG8GhQb8h7_vKMy-MJJ8CM;w)dqQFN_&7L{PSW5qGXZytZ)gaCYg4nT`^zUPY z!AvJYdmE)`3ie#3pz;Ddi^Z_@WI7*Il@*qM!U0b6eq8GH!37+59SuB!qx8oEwpB{D zc!|stJeC@atKCL`+h=!cot>ckP?1P3T|N1ZBY^|RDLu2h{XOHhM<>;h@x2pGB=BwR zQ0ZHYaQGHjweu~r&_%9gqq)OV6kQR%Y3D|32yG6qI$Y; zF?qO^#!=V-4UCjs5XY4g^}%#jWtE>dAOk~3sbz`PTy|wR2JU!IsDny-{P*DUigHp5 z7ddG-G+M~VKam*Jyx7z4;mQ=XmsPe&x=>F*BBpug=sL`FVuY(~t=cG^pz&(P6Tx$q zn4WedsuP2erHb0t2I${(Y7)o6GfHKhC_xwHaANHB4bp4JR?>3lzRthz?GP97c?fdl zT9!#@VxlKHjIQ!{?N7OJ(oIYB^*9e+l&~J>7%#(gF%-hIrB2(u)c**$*!DW2CcrQ z0Qlph${7yUQX9(L))X1}^?JEHFk1$H?48XBrf*Xc8(t`#=L_XJsU`*fGv{mVS$~nI zNR$PeDrBud?-G_;&kQ=r^|ygR9@^r?C3(km*Mbm3-}wR($Y(3X=`o^LU$ zy|bg(h#;Q6PBp$CK`al-Kt+hY?Zz4Pu`=G3BNaLwXf2acn!+vhc{QgRq(K>od$$kv z@Pm1T%+mUP@HixBS=b{Gtz_AFOfibS(eY$-_B06k`)N4 zwe1~juN;-ZGD}+f2Ydqen%>}vQH=SnYpmvMK;npwlwidH-z9DQiX+#-`|Tyg<`MdT z?S_L!LxS&^`T2OkjXc>YKP|$J<&7My6cm1>hBP)g%PrObHLNWKv*HRz!P~dA>0)qb{~fpKQw- z_EIIR3^#ASX?FK0EdVt1mf&XhQ7+0l!;Yz?3Ir{o`+}=hjp{*sC}L^WXA2GA^9CQG zN~mVttnvc^3d>cbc$@&G!0sO!7`2?8)iYr+UgwLj7tas32{1bZ5M%R`qmRU-;aks zM?N~bETvpfp>I;NRhk~H&1ujMWw^}AXSZjS0%``H9+>6rs{O;nY>Tx`2iyPHyTJK< zRW`BJ+UY|5sv7gHtqMKqMHZtv?%^o-4q9I$fbfNS3+K9ys=hDMk@+dDDj7OCIbq{` zY`aq(ekm}n^YZHNMl-`ZQxu%T6~gle!cM6HlrFTmZ(P49S=>_cw=b~8JT4AwsCP2d z=rRrMe+YpS%(-~>fN$RV7XAHITJzE~iYNvV3A>t7Ebc@)`L7h|_M^^z0mk(?ROF>w znx6|}X38^fLk)SKUb6{SBRyTu+9}tip`~CTO1d-r_EM>jZXD-a)t855x}Sk;jOfc` z(bBjA=KwuNRpFbONVhznJ z`mf-sYSs}>?SC1gB)g#hk7fCPrCC*ZcwkEZZD$7=B>R7){r_P~_*S#SUjA3o6@1%- zGV3zh1M5t1OO&ftqf0_e{10h-*f+aQy#t3E4S6`8Ec#vS*&XlSGqz`~*6}wxf{_>S zK62da4|cNCBlOKo^)kbM>qQhl&!NFVt78Nm51=KYu=_UtjdQIS?Un3*C*vV>2NSOx zkdtvsfMA(HZHL@a@OVEnLn7dU=f_QhetQHoEcy#N+u)ttf<$jQ zgSV72!Y8BL!M8pl6O7*tmO!6KX76B)b6@a$5mroV_dgV})fIQsA%-5@P{EOXm&YiOHb-bgLpUe!R!r^s#KA&*M&8TKmgzcLqLh|vz`Ob}U!8|k0+H{4b z;YF(-*tDPF!e*-O>A(J~Nf?i<{TB<=eL;wX?1r-}aX z-=`5NbKEmY7}tkDlDor1;QK`3&we3uOo~qXQ>ZOMuXyal0CCWVz0tza?raf>S-2uB%7_suseW1 zb`OGeO#A?3fmbZ%$(kF%G`?O;41s3B#%#1c2c}XPcc(GBrprYTF9YQM?*REWP6gNbUrZl2L23ubW>G^tM35L2ss8!XXGqMX!HEWZlV8{k z)<|+`u78S%WuZfma3Thn47n3`id|N{=R?1zlw7Rs{OVI{G;z<>5a$&^2Uxe@VCkyI z|EoQ(V3eTCcdKu$cqCYVtTsm7k1vYtc(2)%-t&ntz^!No>*^dLKOIh!ohc^$vb|S9 z_(DEvuzo~@of_#LmlVLb_*6)em5tGFW`VX4LBr ze!+B8G63L&-6Kc?&d9T`&#^`qEgimELRPcaL6K~;MqbWa>W)_O<2w4r#3A zFx^iaGTIw%Vi_Y0SKNaGcxV#M0|;EMMVi5xpE20m3y4oMo8K|fjXINk&_>(2?-g=a zxU>#GiMNff0~sq}UapxsEo~ z5GplVyra2_#d*&o?}+=CimoKN*FptbDYqvqDOhLgxzCo$Y_*rl)$?;ejQM&u)AXAO zstV;}&3cs4d8+3gpjZc-pfK8W96@{KC7TnsDVUz9eB#Yg>=^kMce-IkPv zw5QiaER<;9eb*ow+~V=iQteU-5z2%rR3ecCgt48k8}?=4>BC16qoSb{hYhCG*(m*8 zu#eL41s(6@zVZ}~pEn0+Ch;|wpM=FU$vTa2mK=@B#17PXq12`X>3>}baNm++)-xlC zAv36V8kpUi>&16GdWp*p)-2YMAiqOi(7zq03hBSzu7&kD;weh@wG?q!o{s@<##Q*+ z>+lE@5L=zTkaK>1^gK?3GDqxR4$SCmO53j>Z*Fbnw=T?!)G1RVGN98buZuX)4Fy2D zrILaK$lieVp+P&eO&oTocfofuZG~%NQN3ZgDp=@Qz`DwHxjGX%~fbwJ<9GwU&s9t{&!Xsab2O6bf8-Mh)2M zZO{Gd_*YRf1hG2SsDQavzOrbpmn>O>be+wiml)i7s>L@CWGV(kiG3g-Z4aptTB%$iw>#*$TQSyCc$ z?CE#t#qM|~beMTt}o0J3(Yy!q3pZ~mP%O*1X6o4Ej!>t6)QMvvt^gqIb552fGj$16+jg?2!u(<0j3Nj{H@ja_(r^ zQ|W@~x#sE5Hs=aKtQg3zFbi+Z$*g}UPXye{MW|Xx7*ETrXNFi}cyl*9Af1yrsW7V9 zmKX7l)ZtNin3sx^NUqk>L~veC_)EfMa0k^3vB$u-$;_3QVmdUE&BeMYH4N%^tFy#5 z%1@&+sRg&$)X!P0gTNloFwMWi)YWA;Bm_Bk*PU3Q!59uK)0P@l8EQMa?y&YV;_vS( zWYoVdYIMI?0G)~Db+uIMY|&RztFnuUbpMr-L?B@TJ4(P`LW8~& zHRsanF=SP`tzoL5Fj@fKnzUJV!&fT_-{|~L1i=QNG!hN4!CJ{EAGXW=#t#2d4{zk< z6+0`F`?WoqH#s|AkHiM ztZ*qATeG6+lOyztzUg|cfwI9=j>2q6M3Y-G{$5UtITa9X85t*>IoD^+iBjVuAW{@D zV2z6Ej_$Q_=4KNpo#oU}MfJ$?L@)S>5(^U%O=>h}nbzN8|4|;uJbq?xG5?S4?^1=M z#=}))_xQ1Fnb~f2rRhk~a!woh-aU-fgmuvA* zXi=F);yLq&iI|b?3i1wD-=8(G(eA|E^OQo<$8x>4olIX+!81n|Wx5f}&^FfA4hb8! zr(<)j|-!IkD&9MUuaSue^2llJSdre^*8HG8{NY6A2-rMm-4YB!>?miNb@H8ys zsdDSZzQ$kW%H=<#2^JymSOH=*vS!xe8gaUKIt`$T@qSU99ncG2v!#bB#T!@8#lf?l zZ<>VNYsokd!?Fe`q?6L?IK)vt7|-xK6Yhi;`v@7$BZ0MQmI!bxtfS%(*m2OIh9NYN zm_<(mJRJ*{M)c+@o`_9r_yeZLqUV$8Jvzg94)DKgK>>!R3g4OC;OYt}1-#G=jav+& zE*=sE4^{PCCm zd+^!oiQ-+nY^QG^o7J0#Hci9 zwQgYZbbS%S=$1+EXJp*3Ef|``96k3Higg?mIo4HbYQ)-Vi{z3Z=^`RKl0mOrXavP$ zj*Wecz@TxuZYw8C+hq?^JfC5V#wD^d7LXpfGv;>59Q8xwOy4?QZ;~(y)D^q8&AYE= zwEA2!S~!`Y45uqu@3h!v!gSiBV&P#05DNAVGjJS69PUT;2(c9K^Qa29ldbWVl*F~* zNh;`#OfBWyC~C?4rYlc&*&Edjm?|s%)tq-E?{t03;_Fv1q9o<2zF~(Bod{7Tjt)J-Z7eJ|b^MCKN(%Ues-kp5fD;(HU z5{tV3FThmnWDU1W!3YLS5qqtE?%c=Fp?|SBOFIqHqQegH{Sfqb{xEyV=&>o&R{i|B zZAIibgl908K!F`CadCOc;ZUteEr>5inMgU#=X|0c{f%NHT1IYiQ)z`iITZumzn~xk z``U}YFJdoZsrvq!UxRX#-ZA8ZxBXv~3^0)ruJ#_q_|H(j|LhhlU$t2FU)0>m<_r*` z_1_<&L(%U+{?FduDLUy$ zcsq1tr?sSV7xxue>hW*efB~}wjFSce?TbMt9S^T=R!&cMR5+^kA2McEMI!mN)r)1| zFFi4+2j7DP?vX)w#7^yALdc6GWhPU9jjWy!b3+F7?|CELIM!c%_Z0Pg-deIVrx&0FS4(=AZoG-7gtyvTnW55oD`pf@a0DqY;mOWi8OXPSwB!_YA z!Bphv;7|s}zF6|n3sij1E|7Gup=kr>VvSY~Ir7f zT39hhDgU*7l*s zcsR$#-B4HS@eZBdxzWc5oWyl(cIT2~e5uj5EZpWWob;S=w!s}x)m*{vbL!3kIFytB z>XtX)Bi4Zr%sjIg--5{Q{v^Jw*>?#c!{iIz?SjL8uIOnd@bRLH=4Idg^EMD(xegSrRf=^KohR28pv>$OOCrw0r8rNQM3 z^?A1$|0-K9$sGfL>TDTP$<_x^lL@XzFt>I$C_YOt-M&$*3sU|h+F|vWQF05N3Z}NZ zq^(6Zsbf~z_8@wS-C8eJR28GO^U18T8+WoF#K)a{U8_}!SJm0(iM{LKCTZIl^HPT( z&A6H0Kp%nRT~vE4m5Hd1%eC%PB%#t<;`!mh`OOpKB{GHF_!!y}Udv?bjvodH(^@?9 z=WoN|ws(XIY`rlMU}s{mPP^y~x9eU?;cm9UipS4aWnkm|4 zqmiHX_O&Qw3_>P_d~W(rHo&4-e)&t>5}0Q(bYy90v+5XgQY_(u}JwZs4vTX6Cukb z^L_vW-l=X6?EX8W1@Nxppm6Kt@M5zzj(2O=@pxTal}W2NX6r4Dw;nB<5(Wg%HKZaR zCTpW7ym$i1{$Y|<@SN`_pYOs-lR1YwZikzEvG*S0CYr;!P|deo*hRhB7i<7et>9_A zK~r-_6#`hzoFkM0TNAS_5lZ9E_2Dggllj81G@e{2^8}Q$&B#RldhzC&B1JC$Jv~#8 zaNKmcB=pm0Jc!9+y_FA&ki7pxr_p>pZpLe7o39nc|{Ze}5v%AV1+(sAw1vfN*wqvWjT)_8Jc7e5ROf<8>Vw=Wl~m ze=A+(z1mt*q}i2_#Q1?C8&j=+_s6m_mFlOq1zK}Qt+g)`=9_IQ%6qpjKA$x$Th$ZQ zuS)fJd9acBl0OyAOgzE3ixlL&%2!Q^SWS*C7ciLl?ylOC@~NEZJe|H+WD?E=9+Au5 z^Z5)@k~O{fjv0gmxbuw`Dv+Oz(tN&&=KCd8k*D9jAeg#*%@9*UHX~P7D5Eh`GKY7y z-m-bkHBukELHKAZCA;HgkkcpHo0fL!M%pkFy?iU1p6-N=EYiPXjf9l zSRWxlM1;ApAO~+QaEnH1MIY4hd|jpLkp)dm{oouBW&oh&!kjlXCd0 zDeW#D-$Vy#f}<0-SN%4>7=8Xl*|@pfp`0qnIdkgE3kJ>Mi8D4eHf@~!pdeCg{p z%>)WENhgg}t)o1jC@mkU$PFPs&XMcTdVOyur5eclj8^eTzj#9gtH}1trRJKfuIeS5 zOL>cA@vv(~u57%&m^eZP#x1;y7DC`JVWdZ(4W>*cme=|88*X5dl9E-rP?QJ;tCeW{ z-K{cwSP1J#yE20l(P2OburFX*p z@IrUhZl=vn$mG_7J@$y{Cb7)_GuHON{KE0YDsKua3M|i zj<|cM1u-7a3YLMWuk-LnuAq@o66nB-?#7=AQ?ePeG>dHrO>HfCT5wW=_pLCS^PA-# zUg`W1YXJqkcP<1R8x8T`PJ8YkR%Rdk4Zo@G2ncWImtdp)R698JbvIB8KTx_;#ESF7w?NV>|q&&oDoUc4KHLY43HSBdK7Qb7oWv|YST_t8~cd(pD<1LR_*87dQ(m|kzoEAO-GXIRHIMv%tXKhk_JB-o0rmRqs(^iM2rlOXJzGQdrqZbkip0 zY=Jli90+9DkIT!>Z9{2cT2?b2i+N43+nGzha*?+Q@bfmKb!;ZX2=He6Zgj4;uVH<$ z*l>T6qkgkt)fXEhWq%NU)o>&TIxREXsCz~EhX&6%1PmGV^fw){H-D~Y`RB%9K2CrL z65;lCBH&@`@!`$qmr5R)nnZ z?Owozm-;nmprgZCO*m6N!|Nzql)K$Y>aavr4+yPc=9O^*5iDDXP!+2BtJglop5={b zw5qzC4SW1rTv&<2B1~uY(EYHv`iv%Phi>{2^3(ewyEOY6OPb~k)8(r6$Pu;nQt%_> z;qaE$z*t=GSmsI&fcuAN8lll4#4FVBP0>`gEJEcsPVYW$ymEvb?^*7 z!Kh*Jt#B^E8Q8PDJ0=kGzS;b1`wO$%oxhkgX!GyQ^A zvE#v+fRv_nYT^DPc~1unN_mw(98>P4Vgb09yQCg`H9f$=QF3T+7^OV03Ucty-mPEbbOQNCql}v8K(pgB#-TL+q&&03#L5;S0 z7f=(}m7{ng*ZC5K=nt@o8rcAIBkw5jgN&lDMsbxV1s}dVN)0&{ar-b#n>q|o@ zUXp6~HbFm~O}Iv$E(^TQRikbNdbjY@g5Bk0D-fd__hAn!L?$Sk8ZQ$l?vNjd@$ojY z8m+V-JARp1WDJF{2^UDOl>;m~BahOIa?{r>t{ToqX%N>^Db$WE4`MeZdVT$F53Gn$ z)4rJV7#RB?pU@ezG}@xzd2Ug0aTFp(Ml}3>L))l%p~8Rd`UC`0b3F*S5;mn|il=lW z7rw>Daq0OmgjW>?#(mklSO}%er!@HlgZ2%!=L-I{O*DNbY?l{P=jVKEJ7F#IkDG^i zehI!Ea$^wZWpXUG$8tfroKhli6GcWcE{V}7OFl#71D&>Ct;26?_)VgBU^=&5ctA%y z!J!eP!3u~f=*syfHoLRrcsgMs*>^GVdnrlWH?{FUmAq{5v!K_65@Rzsj`rtPR@)5N zK{AmP+Z?{r%Ci+{J)BPNZ7!@IxLaEt`ShVIaN+X}aRoHGCKS6(3A4~_>nsliRinQG zQUoZGah-#-9^1w+d{WL1t?a4nz*r+Uv+kC9DJVy8O(%HxmIUk?_7^o`c#}sYu|+)k zxx(+fqd*}{ywK{L8qrp|xpJMU8NuyTBTQ?LrB`(jcgB7`9kun55v<|sgvIiY3Y;mi zbb(>CyOMfeLc*??4-RFAwxy=!|Zm`gYJ{&OX{s@$$jcV_I0 z>f%CfKV!~&&pWV=@ge@Y_}oe{-!5glJbYBFU!J7N!bBz`SeVdl4t!d3W9*g%@-J$T zZBwx@#&haqA@8gV8D09f=A}knHm?mf*A5Eaq5%tDw*kg)m;UJhU8V#?-!0JdVD%>< z2%$)?U#zl&J_Zki>pt+0a8{mMg6j9!w~?VnmF~~@7@Q~mWXuB@GbKCvV{oGXhM_iu z1rz>V;Zp3VSDHb;@s?|?HVB7Z=!wC@pe*kD-fb`GBRU*0eX6rWcGpH(Kyi--#hgW$ zpNqJhbi4iJC5Fq1?(`SzC2aX7j;mdv79Ion@2q@23SF-S_b=$GI

#64ZeU)VI-_eW}qA z${nT}+7}F4KO{)JZNxjs=Y^?QNI-n9-qWt3ECoCg@_HAHM-#O!&_v|2pb#7ki{fvO zj9Vc*+80tvMNit>GBPJ~_obg2Th!6@hjnwQV;b&f&M&R0Z|3w>8TI;>1I^UgDhY>I zsR4!zTWu2gg8NlE9iCcV7vf++SRY$VkNThP*I5^Vr^Tr ztl!w*Q4J0BSJnnSgbJ(G8fwH!4M~5$I%@d{%c;2HJC85#m6)0V9KEg&xZM+T$<(&! zTmc}BqJu`K1u+zhzM1mVNe)<7RK1?~P_a^H^7gA!JS#ddyc9YTh>L+Em-Ou(VW@@s z1bZgChjR`ELw^LRG?Bd{_r62#WxX&?@LnwDL)1 zJ}rjm?I8r6Niq*{m?6x*trO__WOYJnCfKUwFcmXql$4}qr&*ZJr zQ=JIoLh^*YA1%`+Y0nGBx64T`P9&nbZosUYLgQ>&Qu?UGLB(@o4KO4Glz#PP7%=K> zRI@NL$-^tTlMAU}#0K#oxP2si(~(W0)f;I}$QlgHkKEk@eX6M6ks$Ih7sfCRh^pNV zId~R6H;tdSYvISn3HhIb#1I~htu`xA{W3}>W)419D^bsX(~uf5u~a#gp2oQJ8=pPl ziu_rM2b+<1s)h~;$@PL^tmomtK4I43)uF_+$xyZ_W9r=e`}<)(8+jKUg7UHUI>uAH zC4L30&4k4M8wL*Z9w`5&?Zga0mG%sRG=rN%Y-}kJtETcEbu^kSIj10B+3t@0Ponq4 zB(w%?<$i(h!4SURoQpleR}8PNRorARCNr7lp!S5Pr!DeBte|En_shzD;ybV?VWZ|; zi_3(?l4zd$%MdFsQcW|`3Bi|3ji~yhU!PB0NbjFK6n+;lgLw)3dL9QkdaK%9@o>^; zenj8@@HKtPqnuRl4njnb1WJF^{j%bUifM;o$GN4e!2FqSkc-29y&jtgCt+a=?*oN! zoPbQBEY*0j=+EFZT<;!_3@=hSEEWWdF#8AiK>Bh&0TeliKFs7eeJ*qREkYEEie`6u zDkm34M$4;v_w&K#O7v*n$OBDu9W}U=RNNvZicTTYQ%Akl8t0Dc-l%^WnUMZEN^9V{ zie?DuAQeGF$cCkwV#3kvTF&&dKBab&XwSz6R`iHLe|WI0lG{-Otq>?t0fI^-nbp@$ zfF+y7g5ouz&iQpV5e1{;p$~RyW@D@TO0*-eIxaeH@^3(!S_yPHU~2WRr&#ps5J3x7np>jdz@ zH{})E?>1&g>CKfyfW?q-CSK2OK4=%|N1=rx+s1LX&gS=ta+Z?%QAUYM=KEJV7_gdR zH(pi@_w4fYZNf||GZ~x>=+GT160ZoyL@Iku!#0Q-#m{;+HHP!GTnJ32`&;+9ic`Tt zy8b3Euq@xu$YnJUf{%V^%0!ADm1j!m^}Vw%GE!9~gBud=jJTB)cP&Nwj?KDgNx6BT zWTIv=`(+h(EgVM!TCODks?9>VCT&s`f`uA@jx=ClX#LwQ(ME+VJ2LR##eXcB&wKiG z2u!`zkvEa4eW9zFOQF9YEC!xTC%pNfl{eWAi^1gmNmQf#h`%meu+b(lop39(!FWtW zA}T{tWR-H=IenC@0Rd-RjVyIZr$@L&vogof!fx90;d$yw%@HHn^bfM8AZI}rRhh=P zP7t7pg_z|Q-?GJl6bSG@K21(!bm2c)u>q|xRREk^5?kK~mnq${iu&bHM75?j5`1Cg zSiqq+8-V)1tj8}=VezHdxM&9rXsBs8gTv93uXqhK&u(jY%M8;7yw`t(GZ?g`zzq=h@5 z3ZyLLQ?kAuP$+Qblj`*kOoXOgx&6U2Ft4kJY_9<#Fj`){45= zxtQpVT;XnhIRvxcfvBJ9rNg*qfaw}Ei$LDErMgNh3Qb~`A3FRoKZ+pfKwCH< z#vSO+7-6>0LQ;>C>U+6ZD;#zs70=nl{KJd`4O9SHP!DR`Y1b`(*(fNU(;Chh%>K#Ngz$al3q%UxdYS9ZZP0saBHN3&VM+`Uo@EA9} z>qW!1E}E^;FL3EMPwmT#s!LCcM}CH5rZho6Pz z`~uIYF<2)*W8HG{rUuPgLSlz0DWBUZFKFds3q^SJUS&V&=>?lyB|+)7)?(C${+7n} zcN!Jd;uP5EGAb8c4iOH^JLd27G-pCDl})OVpxj{h#Q4*@-Go8x#XG&#{+-KKFp6B( zAC+5NGM-FNK7R-R{cMAT)UTqPujzWV9aH#&P?nGi@e;4O+DM7-b)Giu>teMrE51Em<}zmcoj==x65#|(xs^D6$Z!X5 z@7^0xMR@&Pc%1OJsiIpnSd1BH-4PhB>y?sOE@$-R&aJh|6asR}Csk|z#&=6(eseay zcO(aFBajj-SZ(Y**%>6VQV1=Vhwn9@ERF(X#%K>cj;PTkCT?9`Tq}eiHm9@&T~qFd zVE1k5mo&hP>$JRtw^zAbI4R+l&a11XpTsZYl7nSpqg@Mm)vl-LqXhRdRQ9asHaLb2AN`7;A?%iGC z;haTNaRDQ-at9A}uQ3`hU7k?`sYH7^<(z^R)~#NLn7nFu+RA4A1L%V>0>@JJ_eIvH z??GE!2?A=gj1U)luLIbfx8YtINiL=%oL6B^8CB*Kw|^BpLpF~KS*M;Yt_>V{(#5=H z5;YptjH78Z8=ow>AtDYickK9EY9g*xH|cVCI)Sw;k#F~~gdRTjD?__IE=(otI8xUc z63|ystCai(Uss}oe@7*&=6MxhNANd2g6x$7CAIKM(}$}i7CJp*zodVWS#w!V^&$&|Q~vgPPh}*r4;?x0DGb?VH}X90Bq5l&ig!Oi6*hGTD0^LH69$_%NKgYZuMzzE}_T z+7X};mO53IxwHrQ5-Wn!gMZ}6gqr>g<|4hbQGU)8`;V7U~v=8Rew?FfWaW!^9?$QLWy$SDlZ%J+oNs9!?@ZzZ)R?#2@c(h zO@iscLvMxW>A8fN;-~6F^~rq_76hXn{T6KMVONCOsdHd3g$Ia3h+H^q+_o}p0{PYH z$79Y>ic@eLi>%6}up=US+*!hbTcL4?wNM817EzCNk+m|#Cf>l~-Y0gM7;k{jIaH|i zg4AAGr|4jh?vhCF(Z}|B?OYOlo1EVMFYIE2{}<$d&AXQ+_!0h{zo+~LCFRs=m+Jfd zDudtVIF^UtGo#CN2;m-~kOfUS^YC;^7X26PfJtJX_f7{dQ$kkSn8?Vl0#De&S;V@| z6kiLPO9B)3gdhfzTEAcf0S!PzsN+>h5VBGSKgeCd#({eB%ZMrSn$lXQPktGcf=q-K z2=08M%UX?m&%gVH^>Q5MGnOL&7`^CYdB#6i_$z78F4i^6`V0A>U;%@Zuy4-!_iUtY zpZ-vaArM75$`4*W0+doyfDpyiDhCh~)oAy$X8D`t-jH2ATF^Qe^i0f}%;k z330Lu8cknx?y5iImAGQ^p!!l`V&XUs=eyid00F73-k4QB&H3jX?opbDnZ=Ib*w?@)})}5J- zW^=16u|wTS{V;fO3u9j5jswv3U#vqw#Ayda=QHtL+FX2d?1R8;*a070+-Tu=2jg<| zbG;9(iO$I2vZ{4&PZcw8#pXdr?~+&ZY@#FK^g2-d?rGR|bQCkvuI^?ld39X*)10XJ zg9-=7)fgDO*;(jnMxc(Nj^sb7MMOcjcmF3@upy*MQ= zb=jh~%=s5xk9|y^%e2*>4Vm^$_+NIRwf5LV)~{k>a;rb)R{JyCyBK!5JSceJJ)mCq zb!O%A&-#D28}s6+J{$?_nx3AnMeWQqhp=&R=}p$SDTDV!PmT}9zMxR3pPLi#@~4gN zR5sU28!Cj|`Btr)z%%)IP^N_xA@%s3+Q+Qi znSsoDSatUkw@aOQUJq>q3@rTA?gS7s7NDfsK=GfG0WDj1QcnUSyRA;l!jZd|ja`b( z-eK*uk+R9^g?!wy=Hf&=rGB{~RSu>~L>XB$R`A+}R;OI^4XeZpXknI<+@7?;1)>Mr zTJ%614a0Xch3tz&ew5S=+>+jc53Q*0Z zd6xtqgHFz_{T`}+?7+w?XkKn}_O@GViPS+@9RwXI#hUXEUn{`WTdXz*Pf zC3l7F|0s;zX#x|5-e^%9qczG7;kGTIncZ*+HaT!Zbw;2c ziY5AoY7-RzG-9P}68qlUl9!*>dyVAAPzA*vOf-4$L~`;Md(M_;FdF8s2W|k;q^^KE zhYLFoXkAa;6yF6Gu6*8}4YKo_8zrLMh8#J>GduN3O5+__gp_#Vv2{O*5A_A`wt zMaxfWXJZ;Ni)mq9g}nfZmR)t89mX%IE@Y_q zzY|}9H&^rQ#!uZyWFZI9(!|@hTS`OwcLgH@E0G3 zM0I!WyfH3qHJ{b3%d(bQ1aq7S3{x4ZveB~fF?S-Zc{6Z-V=uN42?!u|(OI(^(L4;H zL_f%E(zC8W!?U*u%u~^=b0#})wc;nLBD-fVJ5Mp)Em=b9`#Ls&h5nK?chMUg5HW@RgSx%;LX6j;M@oW-Q1^s{M9 ziHSQ?4Q2!cIFsptg9BCKdQau&F?9YZtrB+yayT0Dj5O6eb&+XxW&jPH^ZGmg)xO*4 zzO_Tn&_eQG_>S}O_}gvt)PgE1>GeU>;*L$XF6QZwz_wnNF3k!2%@d#D6_UJa-{*yX z@CU5Rvj8*SCQDP#+ndC&`QOQ6z1^m3R=dH)gFDg1J3zZp>YB}+Tce>9k7@sf^Nj2{ z&YDvN5$bb8Olrcy5tQlHUD%p&<@M>pSozcMG(kO<7FqIc5lKl*h5BhjHdd5EGOfmd zEfhfjvF5QEL$A^|Vquzao;o)1t)x{RhmrfF?_#**^CBhpM2+`!KMG7d*3{n>7z&Qs zeVJ*cqZLZ!+uXX9Z8$zTv3Q-d{`8c^iL;50t*!FH9;14Jm$3%nVr=@LlnS2nnb^0uL z>tnw(ozJzB<Scpx;u1J_e?yMMiLRHt}!e_gFWMm0JuAB>rQZ?)d}MS1q& zM;$XpUEBgvnkfX)*BUr&MdYtHEDF7Fake?pGQ4-9YFSj5)|wTn$H@acdT%Eyrm>}< zn9T-=fwkTV6w&aZD>6gNSl0T|Vi?b2jSxGFE8E@M0Q9$?rSl%skT_CIh|-*1QB8n$ zpS9fo9It8iBEC#c{n;wYY;6lFiEvQU;5z$fBjfC)B*M&7b^Np!S*iWzk``*JVR45t z=URV!KGGI2kfRLH)0@M2VMd}3rW$;qTr+tIacR`zg;xzILI_VFeAhXG-IR`fWuexy zZ%6#bfBm#l@rHG6-kBsM99W4Myh0Y}Q+ThzQ$jj6!HThc=Xgbb3l>|hwqz=2&j=sK$qEUvy?VB!vfaP_= zj0qUv_{oE{1)9mQ;f%*jj*_YBH(n`;KtYe@2e!TCy@)Jjv?Q$W-V+}1MyyFtEr9}> z{$6K-6xV(dnIR~X$x)XMFZ=pW4Raj9uV*3=4ln$_49uL9aFNK#;lwL+O%4ng`)Z}MEQ0rzupCsW)QT`p znexM=-fPT-egca|lE*8%>s}vitB7yQl6WlHm-c%lbStejVr}MWfY3!xeqMR4r zH^9eXY(njRHin`sDV27PNsZC8#>6{Z_om=oK{?avFT88Mdc=4ARQ*&e4u$!*5B7opPdDYB@nY_7`OzsUH9C07^jy)_5SPj+ z;j%0?zi$*$@<-mdcY(XAoqLPcOUCX|!efUvW0eu4VUVs&xJ6~wrKBehN;Z`1_<0Tb zj>N9h)kn_s!=E>+E+~5Qim5UPZ{&OSjr(Vt!Dzk3XZ0A3x1-7?et_|sf}OU&rXc*G z8xthF-Hl0XD9IYd)u8l%xH(aa@=~s-ruf$R^XG3lb}(?59E8K z;v?$0wC|QJ(?l~LW;y)Q)xYKH_ALo6fT4N(`s}0Po#K2wKZBP@q{!{DCxqqU>QId! zK~MTNY~_ydC8s;Lg1;rjb19`=PvbEy)H`P-?-@~A#@p-KziTA2H-g!dQlwfh5-wJ= zp#a=U0i;emE!wQ{y)8o12blKLbTx^J0m?W-+JjogN^Ptgk$6B<&Ri+CS zZcZRn6b8Nj_`i<(ph=};{9@JP!?*xt^1AwoAmj6LHI?v~=~d#l=BH*tePe8)2iL_W z8Co|^8OVg%rRqx)6}6RLr>7T3LMm*}A^lRo(_nIeAfkEMN1067Vb;}NnX@4Wyo|67 z$F7J3zIZ|Uj=~?DTaQ~n7qi^F^^MmdWHcd(re2PlI(+E4n`*F)b zvkBtf%g^QC?r{nS4pfnzPjtk+g|E$2@kww(21g9Hy8MGLNmKLZDqf|8c_*dxclDEU z#yFNz3*KHVl!TCWg<4x%CneO>Y+z^1=_+Y?Hlw!3Tx_qo{`a&Gc6V~C4FK4OU@W&| zjB(!=QoCb`<@F2Y8f6(cIW{9{^St>IKtb<%8$i9@$CefS z*N3)j%RU2eihOz-5uDkZ){Ach~0{&bF{20KN6 zpI*LXJ)%*?x_fOjsNxSe=}(XK+0xWgv4!M;iRFI zR{xPdUd)s~#ZscdKi4xt|4Ks18P$TFdf^3 z!{l!%4pSo|S19BbDE<$MuWg?hZKL=cD@B-N?0;|ir@<6F-V=ZFvv5s+K-H<-N{|ze z_pXvQw|;xEnykl3Uz!ai!}vMS+~6p4_uHY_dB{PSxgR2;A&@ic9hXn^hzv8ZABsI_IHdH3SF=SP)M6E z-l|De!xe0qU)Nups2uhB@mP)|4Sb(GW$fNo%IJ=5@z@BEMR5oP!qgN3-#M)V-)j$* zFL|3__n09|14|M({h_~e5T87nEt2QNOl8E@QOOqN9}BEbS#Fq^o>qS%@1Nu}F{W>6 ze!#*4OO24RM}kD}$i%?-Qz~FwbrGg2g<0 z9k0jO=tOa#B?+kwRxO+c*{J2RLU6#iS!!OY2xbsdYVMP|n&KA@eDx%nGeA?7Q%2$t zd`j(5oNiksuY$KT{-l_?>Ur(h@(ZH&_(M>d$|+bsc3k@O(@Hlko3tcAntHa#5o&2kW0>1GsdxYYJ|;L0(!22%ew3;FA#@((hTJm=vNbnuk@ZwW&0Q}^{FjYF2!P6V_#fR$VZ~pGEUaYBtr@5wA!@D*N zbS!%+MUCAt=@^9soyMdZDks%@JSoQFBR(}wcFMY^E(r+mMy;B2Q{iP5@0Vg(Mpikz z^(D(92eFQ9?Zofog1%v*gxd*(dQTMW%nE& z66KTh`lq0RTzbN5F@QA8b(YW+P9|Fcq@=-_Ru=Bh8az+TN6o$RKlU+-3}R|gvID6u odE
  • Windows operating components - any binary installed by a fresh install of Windows
  • Apps installed from the Microsoft Store
  • Microsoft Office365 apps, OneDrive and Microsoft Teams
  • Third party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
| +| **Allow Microsoft Mode** | Allow mode will authorize the following components:
  • Windows operating components - any binary installed by a fresh install of Windows
  • Apps installed from the Microsoft Store
  • Microsoft Office365 apps, OneDrive and Microsoft Teams
  • Third party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
  • *All Microsoft-signed software*
| +| **Signed and Reputable Mode** | Signed and Reputable mode will authorize the following components:
  • Windows operating components - any binary installed by a fresh install of Windows
  • Apps installed from the Microsoft Store
  • Microsoft Office365 apps, OneDrive and Microsoft Teams
  • Third party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
  • All Microsoft-signed software
  • *Files with good reputation per [Microsoft Defender's Intelligent Security Graph techology](use-windows-defender-application-control-with-intelligent-security-graph)*
| + +*Italized content denotes the changes in the current policy with respect to the policy prior.* + + +![Selecting a base template for the policy](images/wdac-wizard-template-selection.png) + +Once the base template is selected, give the policy a name and choose where to save the application control policy on disk. + +## Configuring Policy Rules + +Upon page launch, policy rules will be automatically enabled/disabled depending on the chosen template from the previous page. Choose to enable or disable the desired policy rule options by pressing the slider button next to the policy rule titles. Hovering the mouse over the policy rule title will display a short description of the rule at the bottom of the page. + +**Policy Rules Description** + +A description of the policy rules, beginning with the left-most column are provided below. + +| Rule option | Description | +|------------ | ----------- | +| **Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all WDAC policies. Setting this rule option allows the F8 menu to appear to physically present users. | +| **Allow Supplemental Policies** | Use this option on a base policy to allow supplemental policies to expand it. | +| **Disable Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is only supported with the Windows 10 May 2019 Update (1903) and higher. Using it on earlier versions of Windows 10 is not supported and may have unintended results. | +|**[Hypervisor-protected code integrity](https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. This provides stronger protections against kernel malware.| +| **Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | +| **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, that has been defined as a managed installer. | +| **Require WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows 10–compatible driver must be WHQL certified. | +| **Update Policy without Rebooting** | Use this option to allow future WDAC policy updates to apply without requiring a system reboot. | +| **Unsigned System Integrity Policy** | Allows the policy to remain unsigned. When this option is removed, the policy must be signed and have UpdatePolicySigners added to the policy to enable future policy modifications. | +| **User Mode Code Integrity** | WDAC policies restrict both kernel-mode and user-mode binaries. By default, only kernel-mode binaries are restricted. Enabling this rule option validates user mode executables and scripts. | + +**Advanced Policy Rules Description** + +Selecting the **+ Advanced Options** label will show another column of policy rules; advanced policy rules. A description of the policy rules are provided below. + +| Rule option | Description | +|------------ | ----------- | +| **Boot Audit on Failure** | Used when the WDAC policy is in enforcement mode. When a driver fails during startup, the WDAC policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. | +| **Disable Flight Signing** | If enabled, WDAC policies will not trust flightroot-signed binaries. This would be used in the scenario in which organizations only want to run released binaries, not flighted builds. | +| **Disable Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that’s only writable by an administrator) for any FileRule that allows a file based on FilePath. | +| **Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically-loaded libraries. | +| **Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically re-validate the reputation for files that were authorized by the ISG.| +| **Require EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All Windows 10 and later drivers will meet this requirement. | + + +![Rule options UI for Windows Allowed mode](images/wdac-wizard-rule-options-UI.png) + + +> [!NOTE] +> We recommend that you **enable Audit Mode** initially because it allows you to test new WDAC policies before you enforce them. With audit mode, no application is blocked—instead the policy logs an event whenever an application outside the policy is started. For this reason, all templates have Audit Mode enabled by default. + +## Creating custom file rules + +File rules in an application control policy will specify the level at which appiations will be identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** will open the custom file rule conditions panel to create and customize targeted file rules for your policy. The Wizard supports 4 types of file rules: + +**Publisher** + +The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specifity of the rule. The table below shows the relationship between the slider placement, the corresponding WDAC rule level and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. + +| Rule Condition | WDAC Rule Level | Description | +|------------ | ----------- | ----------- | +| **Issuing CA** | PCACertificate | Highest available certificate is added to the signers. This is typically the PCA certificate, one level below the root certificate. Any file signed by this certificate will be affected. | +| **Publisher** | Publisher | This rule is a combination of the PCACertificate rule and the common name (CN) of the leaf certificate. Any file signed by a major CA but with a leaf from a specific company, for example a device driver corp, is affected. | +| **File version** | SignedVersion | This rule is a combination of PCACertificate, Publisher and a version number. Anything from the specified publisher with a version at or above the one specified is affected. | +| **File name** | FilePublisher | Most specific. Combination of the file name, publisher and PCA certificate as well as a minimum version number. Files from the publisher with the specified name and greater or equal to the specified version are affected. | + + +![Custom filepublisher file rule creation](images/wdac-wizard-custom-publisher-rule.png) + +**Path** + +Filepath rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. To create a fileopath rule, simply select the file using the *Browse* button. + +**File Attributes** + +The Wizard supports the creation of [file name rules](select-types-of-rules-to-create#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (eg. DLLs) may all share the same product name, for instance. This allows users to easily create targeted policies based on the Product Name filename rule level. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. + +| Rule level | Description | +|------------ | ----------- | +| **Original Filename** | Specifies the original file name, or the name with which the file was first created, of the binary. | +| **File description** | Specifies the file description provided by the developer of the binary. | +| **Product name** | Specifies the name of the product with which the binary ships. | +| **Internal name** | Specifies the internal name of the binary. | + + +![Custom file attributes rule](images/wdac-wizard-custom-file-attribute-rule.png) + +**File Hash** + +Lastly, the Wizard supports creating file rules using the hash of the file. Although this level is specific, it can cause additional administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. By default, the Wizard will use file hash as the fallback in case a file rule cannot be created using the specified file rule level. + + +#### Deleting Signing Rules #### + +The policy signing rules list table on the left of the page will document the allow and deny rules in the template, as well as any custom rules you create. Template signing rules and custom rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. you will be prompted for additional confirmation. Select `Yes` to remove the rule from the policy and the rules table. + +## Up next + +- [Editing a WDAC policy using the Wizard](wdac-wizard-editing-policy.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md new file mode 100644 index 0000000000..b94efa4c7c --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md @@ -0,0 +1,21 @@ +--- +title: Windows Defender Application Control Wizard Supplemental Policy Creation +description: Creating supplemental application control policies with the WDAC Wizard. +keywords: allowlisting, blocklisting, security, malware, supplemental policy +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance +author: jgeurten +ms.reviewer: isbrahm +ms.author: dansimp +manager: dansimp +ms.topic: conceptual +ms.date: 10/14/2020 +--- + +# Creating a new Supplemental Policy with the Wizard \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md new file mode 100644 index 0000000000..cd11f70511 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md @@ -0,0 +1,21 @@ +--- +title: Windows Defender Application Control Wizard Base Policy Creation +description: Editing existing base and supplemental policies with the Microsoft WDAC Wizard. +keywords: allowlisting, blocklisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance +author: jgeurten +ms.reviewer: isbrahm +ms.author: dansimp +manager: dansimp +ms.topic: conceptual +ms.date: 10/14/2020 +--- + +# Editing exisiting base and supplemental WDAC policies with the Wizard \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md new file mode 100644 index 0000000000..7653a2e3f0 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md @@ -0,0 +1,21 @@ +--- +title: Windows Defender Application Control Wizard Policy Merging Operation +description: Merging multiple policies into a single application control policy with the Microsoft WDAC Wizard. +keywords: allowlisting, blocklisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance +author: jgeurten +ms.reviewer: isbrahm +ms.author: dansimp +manager: dansimp +ms.topic: conceptual +ms.date: 10/14/2020 +--- + +# Merging existing policies with the WDAC Wizard \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md new file mode 100644 index 0000000000..c21368ab72 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md @@ -0,0 +1,53 @@ +--- +title: Windows Defender Application Control Wizard +description: Microsoft WDAC Wizard allows users to create, edit and merge application control policies in a simple to use Windows application. +keywords: allowlisting, blocklisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance +author: jgeurten +ms.reviewer: isbrahm +ms.author: dansimp +manager: dansimp +ms.topic: conceptual +ms.date: 10/14/2020 +--- + +# Windows Defender Application Control Wizard + +**Applies to:** + +- Windows 10 +- Windows Server 2016 and above + +This topic describes the supported scenarios for the Windows Defender Application Control (WDAC) policy Wizard. The Wizard was built to provide security architects, security administrators, and system administrators with a more user-friendly means to create, edit and merge application control policies using a GUI desktop application. The Wizard uses the [ConfigCI PowerShell Cmdlets](https://docs.microsoft.com/en-us/powershell/module/configci/?view=win10-ps) in the background so the output policy of the Wizard and PowerShell cmdlets are identical. + +## Downloading the application + +The latest version of the application is available for download from the official [Microsoft WDAC Wizard installer website](https://bit.ly/3koHwYs) as an MSIX packaged application. Additionally, the source code for the Wizard is also available as part of Microsoft's Open Source Software offerings on Github at the [WDAC Wizard Repo](https://github.com/MicrosoftDocs/WDAC-Toolkit). + +**Supported Clients** + +As the WDAC Wizard uses the cmdlets in the background, the Wizard is functional on clients only where the cmdlets are supported as outlined in [WDAC feature availability](feature-availability.md). Specifically, the tool will verify that the client meets one of the following requirements: + +- Windows builds 1909+ +- For pre-1909 builds, the Enterprise SKU of Windows is installed + +If neither requirement is satisfied, the Wizard will not allow for creating, editing or merging policies. + +## In this section + +| Topic | Description | +| - | - | +| [Creating a new base policy](wdac-wizard-create-base-policy.md) | This topic describes the how to create a new base policy using one of the supplied policy templates. | +| [Creating a new supplemental policy](wdac-wizard-create-supplemental-policy.md) | This topic describes the steps necessary to create a supplemental policy, from one of the supplied templates, for an existing base policy. | +| [Editing a base or supplemental policy](wdac-wizard-edit-policy.md) | This topic demonstrates how to modify an existing policy and the Wizard's editing capabilities. | +| [Merging policies](wdac-wizard-merging-policies.md) | This topic describes how to merge policies into a single application control policy. | +| [Deploying policies from the Wizard](wdac-wizard-deploying-policies.md) | This topic describes how to deploy application control policies onto target devices. | + + diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md index 1d18afd93e..bcddc618db 100644 --- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md @@ -45,5 +45,6 @@ Once these business factors are in place, you are ready to begin planning your W | [Understand WDAC policy design decisions](understand-windows-defender-application-control-policy-design-decisions.md) | This topic lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies. | | [Understand WDAC policy rules and file rules](select-types-of-rules-to-create.md) | This topic lists resources you can use when selecting your application control policy rules by using WDAC. | | [Policy creation for common WDAC usage scenarios](types-of-devices.md) | This set of topics outlines common use case scenarios and helps you begin to develop a plan for deploying WDAC in your organization. | +| [Policy creation using the WDAC Wizard tool](wdac-wizard.md) | This set of topics describes how to use the WDAC Wizard desktop app to easily create, edit and merge WDAC policies. | After planning is complete, the next step is to deploy WDAC. The [Windows Defender Application Control Deployment Guide](windows-defender-application-control-deployment-guide.md) covers the creation and testing of policies, deploying the enforcement setting, and managing and maintaining the policies. From bbf1bff0771821a4d0ab178a6d454a0e91ebe9d5 Mon Sep 17 00:00:00 2001 From: Nathaniel Chin <22572406+nathanielcwm@users.noreply.github.com> Date: Thu, 29 Oct 2020 08:04:13 +0800 Subject: [PATCH 003/206] Update windows/deployment/upgrade/windows-10-edition-upgrades.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- windows/deployment/upgrade/windows-10-edition-upgrades.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/upgrade/windows-10-edition-upgrades.md b/windows/deployment/upgrade/windows-10-edition-upgrades.md index ff9c6ae451..033f0e0e0d 100644 --- a/windows/deployment/upgrade/windows-10-edition-upgrades.md +++ b/windows/deployment/upgrade/windows-10-edition-upgrades.md @@ -93,7 +93,7 @@ You can run the changepk.exe command-line tool to upgrade devices to a supported `changepk.exe /ProductKey ` -You can also upgrade using slmgr.vbs and a [KMS client setup key](https://docs.microsoft.com/en-us/windows-server/get-started/kmsclientkeys). For example, the following command will upgrade to Windows 10 Enterprise. +You can also upgrade using slmgr.vbs and a [KMS client setup key](https://docs.microsoft.com/windows-server/get-started/kmsclientkeys). For example, the following command will upgrade to Windows 10 Enterprise. `Cscript.exe c:\windows\system32\slmgr.vbs /ipk NPPR9-FWDCX-D2C8J-H872K-2YT43` From 97929f6f9264c183dc7978818a1965a1883767bf Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 2 Nov 2020 11:20:46 -0800 Subject: [PATCH 004/206] Fixed WDAC typo in TOC.md --- .../windows-defender-application-control/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/TOC.md b/windows/security/threat-protection/windows-defender-application-control/TOC.md index 731cab3d76..b29a8d0e37 100644 --- a/windows/security/threat-protection/windows-defender-application-control/TOC.md +++ b/windows/security/threat-protection/windows-defender-application-control/TOC.md @@ -22,7 +22,7 @@ ##### [Create a WDAC policy for fixed-workload devices](create-initial-default-policy.md) ##### [Microsoft recommended block rules](microsoft-recommended-block-rules.md) ### [Using the WDAC Wizard tool](wdac-wizard.md) -#### [Create a base WDC policy](wdac-wizard-create-base-policy.md) +#### [Create a base WDAC policy](wdac-wizard-create-base-policy.md) #### [Create a supplemental WDAC policy](wdac-wizard-create-supplemental-policy.md) #### [Editing a WDAC policy](wdac-wizard-editing-policy.md) #### [Merging multiple WDAC policies](wdac-wizard-merging-policies.md) From 1539eeb41ff9599f311409cecabc6d3d74473165 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 2 Nov 2020 11:23:10 -0800 Subject: [PATCH 005/206] Converted **Headers** to ### Headers to align with style guide. --- .../wdac-wizard-create-base-policy.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md index 269ee7607e..0d1d32ff12 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md @@ -49,7 +49,7 @@ Once the base template is selected, give the policy a name and choose where to s Upon page launch, policy rules will be automatically enabled/disabled depending on the chosen template from the previous page. Choose to enable or disable the desired policy rule options by pressing the slider button next to the policy rule titles. Hovering the mouse over the policy rule title will display a short description of the rule at the bottom of the page. -**Policy Rules Description** +### Policy Rules Description A description of the policy rules, beginning with the left-most column are provided below. @@ -66,7 +66,7 @@ A description of the policy rules, beginning with the left-most column are provi | **Unsigned System Integrity Policy** | Allows the policy to remain unsigned. When this option is removed, the policy must be signed and have UpdatePolicySigners added to the policy to enable future policy modifications. | | **User Mode Code Integrity** | WDAC policies restrict both kernel-mode and user-mode binaries. By default, only kernel-mode binaries are restricted. Enabling this rule option validates user mode executables and scripts. | -**Advanced Policy Rules Description** +### Advanced Policy Rules Description Selecting the **+ Advanced Options** label will show another column of policy rules; advanced policy rules. A description of the policy rules are provided below. @@ -90,7 +90,7 @@ Selecting the **+ Advanced Options** label will show another column of policy ru File rules in an application control policy will specify the level at which appiations will be identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** will open the custom file rule conditions panel to create and customize targeted file rules for your policy. The Wizard supports 4 types of file rules: -**Publisher** +### Publisher Rules The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specifity of the rule. The table below shows the relationship between the slider placement, the corresponding WDAC rule level and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. @@ -104,11 +104,11 @@ The Publisher file rule type uses properties in the code signing certificate cha ![Custom filepublisher file rule creation](images/wdac-wizard-custom-publisher-rule.png) -**Path** +### Filepath Rules -Filepath rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. To create a fileopath rule, simply select the file using the *Browse* button. +Filepath rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. To create a filepath rule, simply select the file using the *Browse* button. -**File Attributes** +### File Attribute Rules The Wizard supports the creation of [file name rules](select-types-of-rules-to-create#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (eg. DLLs) may all share the same product name, for instance. This allows users to easily create targeted policies based on the Product Name filename rule level. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. @@ -122,12 +122,12 @@ The Wizard supports the creation of [file name rules](select-types-of-rules-to-c ![Custom file attributes rule](images/wdac-wizard-custom-file-attribute-rule.png) -**File Hash** +### File Hash Rules Lastly, the Wizard supports creating file rules using the hash of the file. Although this level is specific, it can cause additional administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. By default, the Wizard will use file hash as the fallback in case a file rule cannot be created using the specified file rule level. -#### Deleting Signing Rules #### +#### Deleting Signing Rules The policy signing rules list table on the left of the page will document the allow and deny rules in the template, as well as any custom rules you create. Template signing rules and custom rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. you will be prompted for additional confirmation. Select `Yes` to remove the rule from the policy and the rules table. From 9b7fd06c9c07e178ae7b604d10f5ac2d14307390 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 2 Nov 2020 12:13:27 -0800 Subject: [PATCH 006/206] Wrote the documentation for the supplemental policy workflow. Added two pictures - allows and disallows supplemental policies. --- .../wdac-wizard-supplemental-expandable.png | Bin 0 -> 43188 bytes ...dac-wizard-supplemental-not-expandable.png | Bin 0 -> 50493 bytes .../wdac-wizard-create-supplemental-policy.md | 109 +++++++++++++++++- 3 files changed, 108 insertions(+), 1 deletion(-) create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-supplemental-expandable.png create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-supplemental-not-expandable.png diff --git a/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-supplemental-expandable.png b/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-supplemental-expandable.png new file mode 100644 index 0000000000000000000000000000000000000000..d59559152524da6425262187a27702c8c075aa19 GIT binary patch literal 43188 zcmbSyWmFwO(@=`>Cp@gMZ11!^2?1KtMpiOG=0+LO^^rgMj!1fd2eZa#a6)_v7#hpeQZ` zQ9h1)_;K;oL{L@`0-`Ds_T>-c$Mttx2@L=Q1d7AI{nMH;feQpgp`@gUpt6hZ$tt8a z+6V!}#p3bb98m$rO0APKI#MeUMYLa4ooA|@sz^v^$d%iRtE;palxg$N8Era9RU5n> zUh8fh=i=wa#wH(I1%Kb`KT0$#Vubal3&9||pVZKl zYvv)J{@tmy=^qEn7{kCgBr)6^Qv_ zO^98I!(P82AU571`PBmB|JIE9bQtdpMyr&l8Zkj{ve5luTE87zcpSKdEvj~6PoM8_ z+N~^yt~(_9jX_9y!Wzth8i0y39zx2wY)5?a(?rP4a4jbkU#MU_U7gkG*W{nEYx|=| z!8u`KYs{1b#gcO^X6wrM+ddiP2g0)p0PZtdOFe$~?(%*ACIg#`K*uh3g@VNWOxT*+`w+JtmyBJo*qmA}+)4(28p=+WD*Mur0Z{ap|QRyDaevdOV(% z;E$a7vM#prR$a6jcQTDDCJGe84-OBNoUzGIOWADHogJ$00s;@f-zpRx&2NuGpin6@ zG~jU?8D4Jc3z5t%;f_RXW7+SANw5{6oI{xk>iXQgXyk0}(eMjhEW#EI zTdq?e3zw+EeK8nsU2)pU`MEoS_Q&tzbyQqG)7?;uia$E{H5@j}VAa=DBa9c;9PvnF zMeMw4FT98VnPNEGm6xYhz*7ifyn`OT7t;-R^&5N%Ps^h^)r)(`)_Pza2~hk`hh)w- zXm+vl+Jo&#Sbrhp_EVl|`1SfyqpOEgjaN@k4qp8iQjDzBwx>7!XDJTuI*U9|p@HM= zTifzvdtSi)L|@dahsjC$Vx7||s!gq(zal_D$Av@;m&t5)=zq@6F8Xir;Aq@LRPo|b7V**bqzyfI1Y{mw634hx^=CjtCK^{ zAMq%l6Dl+0VwsV1+=rT%y? zl+SqM^EPqdFlP-l;H^ZEij2Q8MhL0B2rOv(1d-`}ce*@~sy5rHVccZ{H^E^il53J- zq|D{C22A31+Cv@rw&LqtDqgF}Yw~bb7kEOgOlZS9==DIFSmY<16L=p)MA90NVt(s* zhsU%sRKZP0LzC+xZH?h5S4+qaDx7{?z1-z!^BB`F3OUxNNWlX6)hw6iv4|Ho5Sr+Q zI7GE*6^xf}mxiYssx&{JEDl$Fv4ad#9zxO!L%nx)(`Cn{VmO;qCr4bWbxeDQBWcaz zF_%VIwNO58e}Sm7!p(wO?SIrS)Cp{jW}^?%z*^* zVDQ^m@WldTyM|tvOX{pFcbhbB=JH@z6^9i06&We{1D6s?${I~8lrDAm_q>3B*xCc! zCX(!$Pu0g0@6~dDblI4&X%O@3uQp|Q%-PxJmjxCazSZUTvmG`ey@IS3 zAz?@GmcLb1^bI*G^L9boMEGwb^90;~f^fQJ&5loDlRl;yI_qOmLDZ$KALoqC`D2ye zF#)8n%dCa~&iwGB*<;47)w?Xf7bjK%uHq03amA*rswe?-1+NLp`$RZh*EGx>6Qwru za1?5`?C1Q&PYzEidk5ty&Wew9yG4jcQhfQS=st;K$$%{fbmZpSw?Avi!qnHz=b$-Z zB|N(uko*Z99+Q(Q*#EQqv77;ga~1xHd-A+VPopXftMo)G@)}nnnb}fxfkWi{K=Uij z7-`)RxOmDyd8o};Nf;bt9W_RLaHDo?%VFuxJ)W07i&R0AW_*gR+U)w&U;Foa2Kk;I z_g9`QRV&@CQ=UifgTYB0tge;1SnGFHue9u>(Xt#f7HM2r=3W7HPK2*35AoT*+TzI^lfQeTW4TSVY{V2(dr*!%UH#2|q%KbaItJ8e$ zruaDfh0vQ%+r{P!h4CicK`tMYTV7r+qPVrp`f;yQPrySph)~^W8db3VN>i+M2TWQKJS7AiF<17v|S|nPWL!@ zS}}$$aBQtJ*K5b+A^T#xB1vY^2saP-t1DtCTRF9*FZVq+81GRTge|**!JMZTq+NZr z0M%8JN!N(2q^wHmu$`C7ApHqqWBrhyfV+auYP0c4kWEt3<0pT;d_TPi7pMteQ0sE)_EBvEziZiiA6G7@zI_j*1m(D#lo>b{Hepiyqt2<$szfxYDLz2 z&BQymRap3`+^M7Fw{q)pOak&Ljj+yW?)$ZZ>uJeElji1@r{_E(G%lOo$1P(30b+7f zw4_&nd2wUYSWQ5@w$Z{05~;@#7YUqvenB`sGqWvs4fOLk$Hy>te$;`_4HaG`s`e$n zyrX-ERq;-qd=z^Zq>8rB$3g;qbVD7;nXF+RP0ltf`gMx_AlMGFhrj>!N8Mig9Xoj; zthfeV+nr2lUaT$UUqZNcw!V?VIenmS_x6->>$8LD5~|;-cW#JS|K|AVsJ1iV40g0M zFTMrFm_5PXA6|{vQS3v^F4h@R>5cEb4#dD`>ud#!Vn4#q^m)o`@eZb@<_&LLZE?S^ ze@&x5wcd<{3q#L14K1O6#UcoodA8rGh)k;XFR!0jKa0d!ba>*nx5lGy8m?MajC167 zsX{FQIt$iODWKv8(_LR?SHP2hDD?{xsKL6XrYc4%Po}FQRI_YuYHDhFTK`J#+Q}^{ zuS7lo7fQl+ka{A3oxM;3DN<5VujXdFl}>ma$gA^9KpBz9$V7@3JB^8~RO;`pl+~3% zYJM0~NyA+@hSy6~CSL4&%Gp=OBXrJUuGqXCTndNMTtmStjFw^xs#tl|>+f4clEq)3 z92;3_99zEVgc1f>#yGH$YvPl>YI;sahnaVAGw<>)Qd0yl=tvij&&--KKVe&Wt~-^g z^dPDc_sF$*2*eyRFFEnedAByn)Vxp$))LuSum;0`cBzZSkZzr${0lg~R-G{(DyS(z zN(YluA&gL{Jdg<*`9RZ>w!kKlk?{}(0bLA};`#K*v}K(<(1pNoq(jdsePAaeQVn0i zvxFZqf%|e3&SBF#AAZ(-9kV&RyDGE_)^1uv#-QZYMk_vv<`0ZaL`rC^Ndh1d^hlG* z4D%WxoA|Zo&b4Cbl|5>NcKf0iF7LI0#4c46OU6)KRIL3I5RmnxS==ZR6%;sBT zA9O}}QxFougS%gZw(AR{K6D#Kz;Ua{;8gKY`=G%=_g+AIXoBofwPD|^$&`XhsnwyF zl)~`U=n_pg_X0%L0$~36=4^mQpsa+@;X4ss;1CHLCKMYwlPxtuYEqRjRIY9W_l@;2 z)Srq9$Z>l2b}6+L3&?b1%#QdKWvDEZ;P2-hxF#P?H^twDM@g^upQwHa7Hh6K`exCQ z&*WLPxVfrChMMM6CD3YlaqghMJ&P1nbs;^J2;zOyj#PKkSoI)XyGlN)2hEdQ9Zk+m z;dLT(78`F>l&j{kHpvRn8j-=_f!!wpJBvixdt2+7QIo5tB)o!&G`n<$2#pSCgw3(C zd^!#MO4}~m=3W8PacY`3E~z^$KZnbc)`uI$TMZ)Km087ez5q*XHk-5R+wC^q25W;5 z&mD`B%4E0PK`{x-5UA&xE*X9dfAec^y^Lv)lAYIe$x?@uDJ z({ySLuD1u!YGZoj*7;(3qtx4#HENx5U(_@v->XzY5@)E_1chFB9M0le zHT!IPiX3l?cC>u|$~D33I({1BJ42CY+zG%OYp!f&f8|VX?^Wtq zdUg24J^&%hSLLcC?yffDfzQS2@gmqY{DGDNtADn^z}}zw8h>9pTYx*fsfbX|;U^fK z@_asE`RL7iZ^uK1H1Z}T6r5EVnaLgnaO5l+U{%3SXG+1 z=mDDFKQA3BD>*{&G;P8|VQh;do(C3KRcCKmN>cbN7rK2k>C9|=WKP-&Nrhqu>V$mC z^#bZjYrAVpC%kSl`*r}xu?MIF^(6qlJ^U`CL&~49HW~@y=i6DO;1uV5)8eF|r`yR= zRg%HAPW=a|Eb?ns@Z-Wn$C{EkIxaWhkhwPES@ci?%1+^6-*?gIw{$brzjklb2xZF9 zeD7wD#+6Gmp)HwEbw!Z@!;%g`rF>Yzi*J{Szd*9#*?qI`QXI8yg03jpfRPL~1jO4W zp_2~*Hz>31xf`Eci7ii!(fX9d2s`#0#9uEC4ingaaNup(4cI0-ZF}!F|y|{C#R!>fPQ$v>%YiE4n&> zm1h+^HC3eB)|{A#+0M$wwpMSooX+be6)2C(ah)Ei(HM@9!C`By#j)p#?ppk+2x?W-oL6zP=@guvYlBC4=fxoNjYHe$G6<}>~Ea~V5R2CgnKBR0oU->Qs z8{`HD4;8DFq_A4dwYpx%#l=nKh;M79_DhQrBZJ2J9S?@#FfcF4f<#57_+TX;f<}aR zXg#)GAu%!Mu}XwQzman&2GH3_OU6ENM!>nHYAHywI$jOV+98IKen!yKD)c-)KiOh3 z@YgIH@W1%Le;e%AZ41G^#EBzTv&Hcp9sCFxBMG$3Y;66pa_*rsjiii>RaVROjpHVp zv16juZm|?V`6Pxex2+vFCQ>A#+0{C9nlc9}6*)d8Nqs&UEv;5|Qxji|wmNf_)XAyt zLRrMRgg(VYI-GP{N5I5E5{t=vxmAqwx<~=uvikWs&nh<)S8&op(htwTAAkw>!x7#{ z`{aKHB!G;YBtiZNi4X|bA5S};ui$sN*m%6&Uu||Yz##OSY5ba~*JKYl-^H2?sYim6 zLpHO&P}bgV*0;6FuDmy-V3G@6H0f;;nLxL;vG8MT1?YTTj4u5R#P6Ee_9w^g5rbNn@gKg1fXC(T zz~V!P5uM4Gm5kA@{N1%T21=eL{`i>fyheobp*Vdi$Sro=Ci0(zgoLJJ!~O2L#8aRh zpMF`39h3YKSOH7;X*zrl+fRUe@o11g9t*qd~ z!*b6{F?*PIeN$L-e3~&j+gk)!aI()^SrQ*;>!4ZcM2A^EacSsob8j-gwns)HrvGt^ zaOAfq^QU}KLI@lkkll1b(3LR^;hR?xIFS?kc^h+_eJX?e&kG48NJaXvN2cV`%F3wm zxpEzDDyrg-|LlPApLV3ZehrkbqoJS>&liJ1j~R;Ap&v<>i|qrVyHIK&l4pC?MQaa% z`=%1*3TMq%<}xG3=vx&^R~ucA=V+~Yn^AE!rmpk~@1_%btf=HpO*?m_3Dssj9O?H# z6gH^zP>`Y$wIa;{ny*W$+74N!6~i{qTbzlgi{HeA5)q8+0TB#&WCu7T$e2WI@>(}_ z72iJmfrpm3!?E7224-0qnE*H}#R^?sF0CgeAr>PdMPmjtKc={!%%~brczASc;m4@x zs~7`(4BaynkW}EWDX9*Qd=XU~DEqkuo-*fL?+2tcsLHZFm9;vVWwiNJuTsvac|RpF zID6xUyt-T~hkAvJWb)B)7mhV1^cr0*eN^1EX{`DBn8BrHGq3%T*B5%ONkzUWCR{Cz zPtP5Lc_x$Rul*d{&lQuo(u7kFMkSb|h!P5Ep&c1ZqtQD9Ho;~o+4K?NSar4ra|5AkwVHWCK;~?7#Anx zKM@v}D^4{%&O%9vW!04CUywvvguh;D@u8Bj;OKWAib3K?99~)!8 z=eIr&CRM4X=7Pj3*5f(nx#H1l*}EscftDU>F>(E9A_4&~AD7!)m|40ox!#Y;`8qZ! zk2^*ZtqP&tm6@L4`nSdqwm)~(LXOr~BoymNerHI2oF$&GQcVre*|e)-jL~e4EpFxf zQ)}3H14zbr4kgNxE5}00_FcOVjxb$f2dBxB(%H6iv#AFSPj)H>a`TKmQ?ZTFf|0g= z#-|{=CcIubtv^(2L&9bQUsr?mGk!S9haTF$Tc^cowZn@*{;LJJaP#mG3l$Y`xh0Ab zI$Nkf!UIpsm-CFHSTf7S#igmKDf4EL{~C=A;J?3Bh9!UZcaxkZkIjhUPGNeC!M7nf znn+>oQ4quEr9-F<@vI%jmmjV{6v21BdjW$x5e@IY`BXN(64#l*n^*rZRbov#X2{M; zLOLqHyIqWu&;(7w6HPd+geMjyH!jp#nRn;S^499Xx&1g(hD=nZ2=X9pTJiY-3_ZF3 z!#i-DcIB?;V@p1in4*FV#FVS$ksu#HU?MC%kBZonVf^TK8P+D?GlB_jJJa4z_I)Af zBZ>3`%*HZeVqzVhuc~F5{?eY;of=~BR2SRp7!1i3P056!=no%?%7dFd;quztG79~y zYjmc=>-gu)d+2Kx4sa_;v0T8C2eLHXi52L*5AiZ=@D!1FIE|}BD`>2$y4CW4tdw8> z^YWVoFvi}QigkHhx{*}qU~0J)qpYwqn6)BI*NE6@s)|^h=H`x-si0kdgu&S|9pzp< z-JY<4`RhmQ;bC^zVH^W$5I5ZCGgZIDhlM`VL#HlCNaMw2HNI_vo|z79kAm2mW%i`C z$xE$445I1{hu!fdtvSkWJw5px^+HT2S$;SHulKkeQdA^~O<{nlBhRZm_rs9cPoFHv z;ZMZf-)=#*q~zY5nsry$J7tpneXZiYw^5}BHKXQvxGGhG=h;1LN{fJoi0$PxqVd~D zbaAVnuXd&%BQn2Evi^R@+Rx*VvINi9(4Qj{1^YY`k(KZL6u}p07j{8=zOsJzWp|w7 z1vH_YSS)c*WqE?2@*E#rKan2u;G(`%WbW}3X6IGjhG9V}X(Z#cf}^+}Z#QUhYFoXo z=eugFwcV`fR`VHId_{37VK8yfLswu*4r)p6nzf-+&6U1$DqT&$sJna1Vje~v(}$Av z0)O^Ar@fmRxpu_n^S`?q7r!jsVAE22JbfDsI_Sk?94bhhJ=7=C5AjrM8h8m)HJ6kh z{eAV(7SHgs7AN78mtID4J2!16rVZ5+VyO|e-S$Co@)r|NR&y*Se#Lig3qd5^^Ff99 zWSW1{zUuF*iL8u!CQ;2GS3b|7urvDWeFPvNF0gR9H($r6#Was-j&-^^YCio_CWId3 zf5mtHA0gNHd%3Wd4~pljW8Vk~g(G7PX220Qrz_jIe`2kOX&2b;?_o6?C5-JYganc zl}!0mpEOmcx@I)}?i|Qg>QbOTO=i_l&cVTxKEx0M54oDWgGh=bLguGzRIaBuH~sjK z%os=*mh59wqGbWzYRaBlmSgJ0672ndJ@5t7wOyrlV;DGQ2r)ICEJG?SR(nzfK@l!HXHh* zCkpX-AVO_=C@MXIWi8Iu@BK>Xf_q#b7FQqN!vT)p8XWed%|M@nwu{kxc9(BiwzYe& zS-23tg+(BdlY&~|ao|ikK_rL6@5K1{G3h6Bs$xu++d_-Sqy1+C>w-<6$uaK-wp(L| zlT~>OJk4X)h2elDY@n3^>!8IcQS*ypZ|hXK_4ApL1ptY-DE}aRl1px-vAcZDN^PdjqJ1m}7oq4t| zJ595)SLh1pfZ}3MQS7fKmoC5X`X2C{?GRFfFqP5vgX$ijCH0-oGBFBu7c{gYb({aJ z&Ph;dWk;X5;iMZIa>;4?&IIz8rH5**)eJj2(l}z-wi;A{O%d0fxBuK~ie)j20c~D{ zl_DA*%rH$;gnxTn*j)|Z5;+X*b>=->Ak@@hZ?!O9KCRI^zvt}*EvPT+jfi*~KtPql1!si9oNtYoTGL7N?7AEEOF^@c~eExZH(hoEGJ0%tJYG|RgP zcq|omG8Z>Pp;TwUG}creL1po$jp!*X!q*ZtEm7%=i2Tz<>4uwAu<*+b;{)|B3#<$1 zRLL3N(-gD6EW zoLMoXct8~55w&jdl&}>DED|nCM&5d^z%A0+C&4Z3IDm9vd}a7~8#rXCd7IssL8h6r zSK$D4*Fi{z65JkPKlb#y_|3$Ne50Yk)xuOv47k++4n!od2LOsn^xv?hf!LO=y}4Cw zXR^mY>w(~XoB&N5cj>)za}Gn^wjlSm`r)7j3qXsFyUZ?j@Yv;P62`Zpp~P@*`rbnm zXPaNJKZnf6biBR;GbMk!t)$d~98*a%B+Q$)EH97D4%x#rCrBl6Hzqw|!Ya)g>1As^ zOY*HU)IN8Ya9mz&j`U}TaM)S>Y1mvw8Kee`_4{p=%7dCKB&+@F^C_h-zo54lh;Yuq zy361bte2XGo{<(6T382SqMxhfDE!$O6E!yIw*ABHw-%F2=jronOFJew7g4hK@CmR4 z<|OaApSP$>@jhpXv14%wIG2|*<2*ka7@S(g(Cy(AmLrLYn`5dYAL2okq}Nu=(E1c9 zJe^|_%gxH8&>XGY{Az*|5T~v~Y5dg5u`?sayu|qpdN+1wI9)}5dayw&V5a5QI$uz^ zSpM16u>_uv-@VPAqp5&%qicu2yOS7riC`_tQ1x}fxueMf{8)6#y6tO1%hPJwk~XC2 z4#C&pX4!(uKB4}caeIdia92H-ofz`9hELG$m*z7SE6V&<*Da)(YUiYg+OicElb#DTKu*iT6 z$KRuvyfkYXX)&}XL*(*umg4WH;N2fvS}(tymXe)}6-%}{8n?vV0BuJcjQxtR_mwJS zaX!qh;<8ZX{r7R%J+EhDAoYDQGW??q1fxOjtH08(Hh4v&+LZ0HFQVdlNpok^UP%c{ zE;He-8Bea@8pfHFH;5P>trc&N?IlZBNxEa@^H6@&3$0~jbolG>4!^#qlh$OIsy3cN zfYhd2q>(Q4O)~!LQ$N|wo%@*PZCk-PTNGiFjHJ%BveRCB*u`y{!@k{k}t2AoI}_ONSLdZ1u;Q;#!$j9#b0K<*4QoE7wq9icd}Z) zsp678mzjNRX0wEUdb|ijair#%zV?Slt~Ry(LR02pj&)f`HN0P=C}nH{XzOczWcJoa z0oMGXM!01cmC|QipA;JwC6txxdD-aF!MDD#ff4 zGkv=s;97RU4*+!OS6ujWlw_4!T8ryYmMs@{$4+Twm(!)Lq3n}8j5GzP^AtlSsEb2& zuy`$7{={Dixiv3a*s3aZAhB6PzVJx*Zc2kDf`!cqlc~M# zv;$)5YIDh|35$6QUW17wrplPO-Emj{+|#b*h&z>-Os*UwrLz|sWt_i_NEduh|HaJL z-MshZg1AbM49hXNaUu$aa;mY$#m2;FChx>YTamfm{V2PP##l)5Pk%@mmJ_h7A4n!&b=<$+m)f*SQpn3%t-?MQe~lpX2#Q zF`E)6(&Fz@gQ#a-(T=eh%D!Lf6l@`Ee9?^x%n$H-H2Li5jKuwpLctF8?mw!*2gkoE zk!PODfco8?tqcZkDfZqzPM#43d|?%2Bv?^83C?8iC<6e@jc8M$ojIxSnU@i_W% zGo_pfW-3n-)G5X#3idw=-eWPIrk-w0NDs;=cO~BhK>L^5g`3ML;olZ@$0X5KUjmAS z@^jNQs4-8~o?d0IK4YySs9isKEB}(G7EO98OeomcTzR~Q+_ta?!AfCwsow6xI5o$n z)HN%Acs&R%#`aXrzLyWzV^)qQRoKs_)U)wZY$2v5p; zOb(Ji_c`g&m8F%5D&qW#w-hEk%X47Wl$4!vreOFqR!hlSLC7fRS^u0IS)c1ZnmZt# zl{-GSnV3y8m*^#HDECbh8*S^{FiuV2Rxm*=^Dw5~*uivE9lb(E5BYUU$v0m=UNItY z>%+`k!_>8p?xv(?>Nx{3aLn-;PQ%wp;$+UH2bvtIvE8c*)H$ID2DEMq1V>!4^|vY| znQ30{FxxmU4x;lJ)m-TNorozU$j2=R=Mu zt_Vxk$s-!aa^-4@zV~??`F8r55hd1|bq`5^Q~74;T;T=xY@N?o#It*}$+E#&r0VP3 ziuh~>A@A9CcOSzYXRc!b4Cg(8qEU*c6abJkCvkLZJA_cUOIqB`bJXtc=es_)f1OWk zSuT)Gw2|PlV|vls+^mmZezBWfff7_(7|`2SvFa)C6XV@?t7&S(Q40=pCIh`1mqAu= z@Y)c(-oLOQ9SZ{g*ygaGo>Rh6gR@!y2ANHV2kz_4nKa=MdejX_Xv9rFoV<}02EOWi<;ZR2$6gHZe1R|a>2X! zZa0v;FToc_Y}WDf-MrjL!mI>x;#qJ;p0RL>SUew$V%(k8aZm8#nH#hi@3$hT^glm{ zY6GJJslLJ)rgYCxW3Q>E!=W4JF=~Oe&6n#pXYmoPSMOId@)zmP9RqoD*}tR!_BZ z7s@LBGNH!Uk&N<{*T|Zi?Q0iJ5w?!|Oowlj{Q}|Oxb23{@?+H-cZHF|->){OC8qh- zxO6D;XGc$sW?^-ZN0bNX`mvk|5cn)|uy>eh0mK|_?d@Dm8C&7E;EV4U&*Z=JPDJlx zgd^4|thjtafMwr9_9GjghN6G-IZ@Z?uSRBKN`UX+|C1 z0YOGo5m)yzLwW=4zRD>95lCD5w;DBuk9(zWAm|shF((|B#rlch{h}E9Ge|E7pP^)& zZ?~Oqy82@}*9Ev+3dtp`&DbM&jz!Q()f1QXX3DNR8OMtw0@c5vw|NipOs6)F@%^@b zG%erDa*O;4lrY6_1{3&ydwvD|xDQ?v#pAdXMZ`fnEp@~|G0J74Wk8fLpFApWkj^3) zRqM8lU2Dt3p?@@8XQT1PFBbv-4%oe=qcbRg15v9?Zl2C;rZ?L=iEXt^5FCx}wF7dW zA~ZRvZIuni^lG&wG0-ZW9|`uLlx=EwXC`X?)bs8=GnN%`{4}u{Lf9EDlytq!LC{H6 zx+41OsnwfMmQ|mj=L$nL%#PcTfg-C=qePou`(r=Osjyr;B~1A0l*RN|u3%r&mY=4} zr*4%z2wd3>tNE8Ru-q@$AKv+n1YA8{u?;QL3ExiYBjE?mc`Mx5;W2EJC4#(!tPEN66PJFKNVUf-6^gvlBW|=v$BtOIt=N@(O3d5y z_Xp;{rRC)%YmfJ_&fs5SZG!C?{3Hi*w*=#)BS#}*o@pHbExoD1xdQ*Uis$L>j356R zz|ViwnQ;;CN`auv{<-u^^u*L++x>HGgcqMEuzM_ki<`+Rt*3*3UX}!W~SWyBeY0HVI3gVcU>Bi4i!n{R% zf50HxJ^CC zYZS`b=GyKqo|09y@Y~e63viVblbkhNN?(tWY3KwujyEeJo=ksYgd`O#2VDb}G%Gq;4- z(m&6^d}kcE6>fff5PqZ6w%>VW5BV=ZvZ3|>JlTQmEAV{{R7cc!S6uvgA1rsPX|6%U z#IjxBDI!WhZdeuMOb~32u3)U{qzP25(7-9TO5*qGNgD$I_b>(}>!kEm4_|Y%w25vh ziOK~=^Z5SCw{fT3TvQQnR*xJYJJr{a+oW*kd~rKGHU_bmT8s=0i%68KViLw(U8(q| z)bU%zjm4nv?3)O0{0j}g-`_51M8&Sn*{zlHGM+jx_2I2n-^oht!e&@&Tm3eom>5YI zR{6-5Gm9TF=MOCuZGP(~Poztazr)2E0C%`e0K#vWssZ#0Y+66qR~ikPVLe3yKcZzR-+Q!x&qCGFuMtyS{m zLkC+vS_1Ie==6TJCaaME7hAznu+Oi2J|d+RGIX-vyJM+-9-#I82EX(;Wgj36a8@hu zdEr^vc#ga7d4~VNQ~54kt=n7n%+33>P})SmWs~13P=CJH-qhws7c4XQ?$YLx^8)C0m ztVcv0MHL)_vm15AkIcPUBlItPS8n5}Dv=kJ@Ulf7{N+c2ygx5c!46X651(#~+OMc| z^3j-qM3~g1T0(gx!4S}&&lLHpitu|ozrrUEU%G|HoVjMDu*T7c`Q~y64t2fmDPS^Ush4VBtdrwQvymIOIVm;|4htWPVDiCCq z9F~fmqMzy7$v8{jZ)|YFf~Cm=*6`7d!GM0*(Az|9)Oi#jd_ifwe1_^SPTtT!rbxO6kq>}QH@8zaCf0UV<1 zyxk&o8K?5#&AEQ2itx#g*xVxZC8qPDobDK5HG1`0Yi3D|6cRKZ8x);eF`3^htCo&0 z!54su3jYdwhpUPCxIns;|Dvg}BeRHHLG2+CR(2hr$wWpfmlrL_d`)w#MpXXCL?Ye?>kIhVKXX!|Iv3DRa$ z(nV@k4+^xDG#Z~C`X0-!fC6h>QjSc=1oXjY4Y$YhdP`YXtx6I}K+mnteoss#Lz4t# zzwrwz`EUT@A=vRbCoWUwFTZ!{6)4Kk zS+7lc9K4OBgKFdH5C|l!1wCw{SYc%6z{}^7?byXJnOO}CdMv9}gt<<_tn$W1f~9Ww z-q%W#nP(8?p_7=gf_sC)bJSjPeV3HJDNhW=M%bS+Io}!j3}D_SHJKcT9P|(s_Wy;7 zwop4;4Nc#2T?@eWmRr@uFcs>|metC?{CextKx6htVYRi1 z7U-fgQ!(+K?7$9Mu!zlWppEU|skvcRIkDS#O!wA!x$wI|A_*;{l0w*x!&F$-cuvoH zU}*{}kkC_84=Pe~2uGLbhWJ3vabDGd_ha5h{Hb)ZbK#Ey&sX5!;Vq&!YOo2TNB4v) zEyJFbMTWxA*YOGO6Ls0&W{jdHIz&oocjXXL>aFiTg_8Zvam5d->1QpN`8b|S0a5E*VUHrtNZU6ujUrJd<8m(LB= zipuhev{Kd&_FB%#EMm?hsTE-HdjI5XpBKGshSJ+U^rAMqKS|S_H}sKbzG+Gn38h2@ zwL-ZyU~zmN%9S7!K9T!;dn}fI{rO}2lAt`ps#qA8qRHWe5eTTmo)4jM@66(Eb@)3Hjuk;N5hvef z@%RVDW8Lh}9P^zrc5fr)>qEE3PcF8hP(J?5zijndh^~&8*n_DgNMJh8q8SS6jFBkXSv0Efl{3W)0TNrXzi1ervTFTVDI>Qn5&~ajww>Mhji-@ zwXL13iL?kGU0i&Oo35Xji(JsHNWi+GRM7MGEv=cnQqP5QdF?AP(bWU}QB)MrZazt|Ld6d>#+yS%rQ#)iS%I%^DX*K$ zT*LMSW2=m?dMe{>US{WQ^Um%msL&pv+|tLUzHxM_x+`$5|VM( zE{WMlws9oalcR)cTROMCCD#8MD_#f>S|}r?W^VFot^Zo3EnENYrn~n+T(|kXU%qO@ zJ4+6p+qR1d_@<*}T9JfQ;CwI8Thb``MY}ujetJmNC*Uj2>6^rP+cAp2fDcXZx5_sp>m9$`}|B$8`@8`v3t3T{h z`mZf@Ogq!vrA7#-J4v}t>W>-NrEs?$y}Svo5j9g`K;jAu(vH^G1zT3(K2i9 z?TzgEyHc@gbPXnf;;`S}d_rdmnKj#REKCXqI}U@J3|Nt|7QxNly+$TNu|x9BH12j! zj&JQ)tQn802Ieo6#t6vMGZ`M7JCKs~#xd{iX$eumME~LMF%P401DF-X#+ET~P<2A% zsY({5kGJNO5$*?eBi3x?nj^P2+l@ykVJbz7YP6 zl@{mH`enL_C1V{ttshbrcXnp^AT2MU)Dl(g48HQmc(`bdz`eB6Wx&;LhH)B)tyC*H zLRL?KHqo(x8Ry`b3c1>aU-n2ApbV;+!2Ozmp7(sb<^cKi=`O>$v-|J!eZYUby#db` z4Wh6fOcbdip}t;5pRrjC*jXu8UGF$u5&N$WklqrZ1AmH;k6%*pqgmOl>nf6{X&TmkIxKq zI$P4oUwEXj6-DuG-uNJTz#wGAjNZ`T;z6Q#)U%ZApxv7MXHCY&KGnd!<%qOG)b(m- za1k?$H)`yj;Yzx5g~FdbC?S*h`^N>k)BNJYqWjoePF%#inS58?qsH6vhnHQgWC zdOFF@e=dQ4e{B3c367h)1zGr1ZD7S1rv3CXi&hQAb4WZeP)ox24{C9W>>Lc1JEdSE}5@_&j^mxR=)A^Yy-mg}Y}qeL%`$MFpNuMK{Tu zx8xfsvT!k7Q}7mI8Lbu+1cZ_31b2}n#T%4&&5Ql_?%zr>GKSzYD#bma$@R;Z$pD<> z4#Ozwl$5xK_&0fxW--k?`p+afb%qqNFQ5KE8j$!Ie&qR48honw+H-6=N={xMuiIJq z_@^+1$4(OG)DXJV?5I-|=J6kbS#+L`3_kpX#7;f1UiC=ZY@7k)jm^eV7;e)*lfqbg zgz%{eQJijtQyM-7t8;E9wU!BIByL|1s9pmxB=o;;5>amkk5A|KW zC4=$J;AP1c%h>M;v3e{%*QMM&S-hmrGLQNBqO|){Y2<;V>8UdX{%vlj*sSZnGAf44 z|NJ@I-EKRU%I1T`OJ52%ua9MJLvbR}pMtHsySz*ww}NuJDLt&bH9DI;a6ZJu!^6aM zwqMrLW^4!$Mb8K}fcB9PkO(B~m;KT3e06w=bC1r~c}p*w+9)u;5@TJHpG%b{@KaI% zDb_^RO1o!^#qsgnnbiX9)L=7ZbtU-HTITAoTcLvzjCqn4#=SS)2+}zM3nc)D=-^FUmPIv_!bF5-4>IX~2?U$*{9Ce@^kx;nDdvU!~_08X{)NA!JXx z@_4xx5D&5_Z%R?&;q%FcdJewzOd*+eIE^RGFYJxbR?X?bmzBmFu(~88FIzvDZXpqr z-&y(|Z4Lj_bdLM2%Ecg-Dw^|n~1N?p1^VC^L15rIHM2vWzz zDsnR-X5PVcLb3w|`+6ez$wjA?lPM1&X4V(5gr`%GL6JBfFB+^Z1|sY0g@je!{kC9LTLw zzu&_lPzaXwmAO{{jTKuPho6sIWpLZM6g11VSdShzU4Ex?(QW$XI6JyZLi^U}ihjto zakH=3@8$*~+N33yw*Fz*y!|E3-B_P5uGxz~!%BJdl2TTUKhvJ?6uX^B$s9b#!ad4z zgRT;!paYb9+g!Crty}e>;%bvn)R|vFFbUya%uIi-I;1^xBCj1d9mG-2p^7rJhgVwh z%70t!(^)}8i$Y9r&~y>5L3{osT@yq~4|3G{!JV(V<3_~{ZncM@tdKr+6NG2RiIHI` zW71X%Z+(pyn+|zWsxoy%mDT&{GLRfyY8ZKbq-F_jS8_{TIPQYGO+^q3w7=lx)sMN) zEf!=g-XqusZSpShm(wxxS()ppDSXHF5GjU3FuWpj>dig&xqj36&@Ye`kN!;4(7*uC z_M-2ONTp*oZ$oVdycbh8y21QhR{$oO>>LYfhtnz|`wsne{>4h%FHZ8}U#lIJUegz8FB0-KMGX-iDbD#nf(TwHpK#-hHRINLRgDK4=mOQLCLw<^z!+ zQ5{2Brr9>uSLW&Ue!Kt~4JYZ;$y*)tXg=AvdtrJqT!qRX!kZhoEgc1^; zoga8joR@E|>yL6;>tn5(N2jGJ8}G&e%1*i`V0LVB`s&3=&FTQw11b3*M%_4dxkklA z^rS?+T%LYP${~DN;f@TalwchDhLZPF?N(~pG@m?2_wAeK4^hCN=w46(vv2es`gaNe zZ*HtI0(p3u>(-ia(wyVx^>uSWP2c1cD+dEcdR~xfF=rKx4@qwHtr5xD@IR02CZzEc z5kZY9)9b5v>s<1uZ!;exh$;1AA2uJJtSRxN1_#Ykddo59oj0Z)^xqTBt@m9OaV=xG z*}&?wf6OuiM10nB44X~SL5n;ZjSXduU&0%{Ru?*2&d$^cim_9Eu2sB$XDvscAPXlkok=gfC5|_f*>AN$1 zz)$KdKaIx7S?@v(e>}7gTheSL2+xI@7`BIz+8Bcp<=r1P$%Tljszv_E)))54g4`?U z+d6*$S-w;Fos|#DQmt8NI89VoAM5bUt5|YTdtwny0SDUvI#D2Z+rHlusn-3WnMsLK zlsK75XaXd;o`u&8H$9c^i@SqUWk$40JR{8@nopLtxKPlO>1J9+S!^Tar)qWSqjb>h z=b>ToQsZ?kxaM_zfM1KD@G3XeGZe$$%OTjyNG2XDdf1&FLUXr83@tttEr&^{-ecFJ zgb@E~2}$$NM~~B>4?gQHnAxkn)7!r+uD^((l-RoCqO80SvYUd@mNi zk<4ET{%8-dn9RHN^VvPLudJd!uAKin&S_vr`q1(Ekn^%7@87cB?Jq2;WZ-so+;Zl& zh*QdKeP_=0GK*=uOSi9lFC|MC7W<`KWIbMdU*m|3kZp;St#2YjkG{-`UP`BTh9XwF zNz{S)kD&G{aLh%SGoXpOv(3%h^JEpz?l*M5dVgyXtKDiQt~Dv9-M_cZ(~kDriVYW# z+wLH(GJf|5Zk3+g|)m^aW-X&NFK^{5D>Y% zY{J+QYJP!a)#tfKJ%_KfdluI`M@_0I`bwIxk_vV`0(##^vA7nAqE?>S$n->zWZaw` zUf#L1CmAJHM+P)1O!V?`QwTO{@bm=)Ak6cbxHf*4(7^&zeCH|nH9B@}LKcDrSBO(~ zEK4f3*LFFa#lQq`yF@*CLZc0it_ThN2i&I%kbOO~9P4pJ`!b8LI8;jeKZO4#Sw)^6 zz3es5wvyQ^fJx_alj7z1pe*iaaY(O#9sJ@-m1?lwFo>Cr&Z!z?2dmqZxyiiXo@V=7 zUNLDp-4Zu9W!A_IX7DsAn%acZ`5q;6I&lb$kdi-V*e}}9>Cl<*o?AQw76eWZ{x8{( zXV>YC{p$$wXAtxM)E1X0)+Udyqw??{PIu7{;@O@Fy!#I~pTO}4p<*C(wdcltSD-PY z8~${=?fC9dp-*%O>cNiuV*bjnJ-xYiIqY-cxSQ&aC7nZh|4w*#=T}Rvc6acF`ycB= z4XXX?sRO6;PI6I~HI^vDM&GB1@x;XSgLx!}I3b;!)9AO>)7TGsv_15gfIDO?!^f`3 ziM6MiJuE$7Ct*a)7 z_))J2q{QqtTDXn^r>kmPET+AMahvh_(yw7 zUaG4wf+j`nUvjHN>Hln4m)n)wrbJ&R5z8FY*l=r4 z7}t%7JT_9mci}5(Y*oEDcvS?Q z2B{X)i}I$|Xyb2fqaQ_bw>*71uhWw@;O-?a!_N&1@E<@+X#4W*h{f;Tv8ETys*A5f69B!hX(Td?%3UqV*^skN6CD zm}U`1DGFT9l7bFP!apbvN>4{dx6ts0FQ*P}?`|nZ1upsAheL@idS>3;04J#I<@Z3=2qp?7$kP!bKLi^|0;1u^!@t zO@#u#L7Q3uvY#Cled8mo4&eQKxbqjnw>((1k+dANLgA$ZEq*ULG9(!Z`m4f7tL*vd zMr7Cv&r(K42P9gJrtym11=ZBOC(Zd<**}W1^wd|~;d-IfaphKG4_FBrPJ1hXz?1vW zO(Rd%{rkl!{- z)R`32nBr(R*_vpLL%0ij$IzB*YX_OIe+k2b(?r11P1lzSd`=!ObXC)AB@2z&gimiT z0H)HAT(zicZKsOzqjdvqZ#5t!ZTd1q9<~Y$v}U%h6FYSnVJv-A(w9|jW7XXs<)(w} z3w0L1pZy^r(&i@V+$n2HsG{AfH1soHpVh7)CmG|Fk5!ftv>Gr~_K1tCl>L}hMKV3f z$)gofcSK>6>sB7%8R!;I8{g1psFE$Ma74llR=gdWcVx~79jPXZc}ULW8*fLoYB$>jQ(`2uU|JB|iv-S&mw@57HA@Hu*(ZQm;e%;AL(zSJ zeE_rn;ZQ09QI8@?8^H@;nuyFiDaV>YxlL0Uti@Y?>qY7KzZ@>kZ+p0=4hY#6Iqe2N zUo`B7Ma!86iWN7y*(mo|gzSF5}U!L*3+e5|E zhsd zzMRbT{N^7CQhuUW=m)L@!-@hiTZBwjx7P_`0Y`sN?XT9n6m3ieInKur+w>27Nvw(R zkJ4LuDr{2eCB>*CD3l~wd~?P(IJ$0Fd*4Q?O0foN2Pgdz`nh1%iaT-7Z%-v^&}2EG zZ~{~TqcD5&eIj5gmuS*dQZI;-#S~)Y5o4#f^Bt?N#i{W>9Jh3B#IK3*iYOW&PpcUA z2QV&H_|pdOCezwv^^iie%U8D&AlzNT#)G;KmZ0BNK7h6Rkp>B_85PP0{gtfd3)3X! zWZNtN_gaMpiZT?P(k)Sz@^Op%%Qu3296AS9YMe3E7sP3VXp{1S{Uw39$O#| zw@T|79OOjWIFNZITQ93=C)8*rGljRS7Vk|K_ea<3TwQ53*9_h?oCr<0^`kUDhpXS8 z<8wDEN*n1( z8AzTvt&p=FM^zb#?AvEddh<%Z0YzidxJ=_sJL~-mPLC3#jk%rm8!Mc*yko$N(^RT* zJ=lvOJQ_zwC&&zEnkT$pN@YUAs34t%ehrQi7H(-NVDiY@xtY8`$B!UTwA&$KYpm#S zv4DE&GZ~84Opa>3;55m8L)U4WslMFP|J8kw>O06m2L6tx0< zMF}F@F17)`QaRa0C&vnktYJ*ZOYM|3(wGr~lMW@y#SXn-I#u=jy*|*+ZO)#5$vh-?Ph6AVvBdU*={+J37tAbyh7lXZyWQkgI7Z0nN8xf) zQbG~C`e}poTnQUS|K?wz*`&48nw^W1#W~%N&wHv&*5ahV5s14?6VK)9GfOPJqm|+n zn#xM!RRdY}K^*ki{{+~+%tgZKqFxC#%HTTEHJhPJWgYLs_`uWlX=?6QP}`n;olV6( z1>vKM18uKYC&^TeG0)pzm%zEP`Z5*c;;PKa>EH1^SfT*{*0z6qOVH&vkzXC6OYLGt zd{Lctf%3onVx)N|*Z)SPL1?`X%*fS5L@;wQw5zH&XO{b1mXmvL)RpWqd8f@uKiU}l zsOPuW9*6rXJ79D)iH%l#7cI~aK1qDHQc;{`Y_o5>4&f1@qms9uUFdn|X zdx{;S)KFQ}YmUciyMK$xee)rp?!{4BX7m@G|7sD-U7z+PRs|EL82CiJe((Mht$W4i zr9h#ZeVMyZi^ZyUHoLa@bab=X1^;!wey68unSm2&iWb zeJ0ch9wl0%w@msjvcPkbUt3{~94av$-ADBx`{N~}^i})Ji zY-qq$6x}1B{c%Ie8#P_26haf%`7UyB6L(sIxTKW4zl4qRS*Xj}?`*OPNI>fNL%B;{ z_29v99L2su?#1DGOj@Pi2xd@p2HH6V)4o}w{B~h*+MU-lC-&03w&;%&pAta9KN?9t zOND<&TmARe`kzzx>&m`u4P1BXuCPD~qIEVq?`iM)_=>{3>fqLO`v3m}eHhyRr||$f z!vB@-?Y~p~@&BJ38)V%7b!N7A&pK%bUUg*^iuEoMpVOJNa*c?7ca9X}x}d77*{U)2 z$Cl!|w${yV4=>rBp6eKjB4iseYOmI%7kxmm6|CxA=$7s1e3@x`mmVsd8Jv7pz zq9U7}`9HG)I*eLalif{7E`{jJXf2nZ;8J&Y@bDW|D;F0RUS3|s_is*-$b^FY!D-{$ z9qs=A8Y*@Ht)gv)WYxPDeP*n+vQckwBc)Cymk`;yiEJ)hBKo_-CGvC&i)eQ=X2>y3 zSk~0D8Eh>MD+Ok1ST8_;e!`eDChv`yw5T91NAjAHs2rql*;Yu}-S;JPX(Npf;CsR` zz>al)X|>xew^EI!5IB!sX6usmysxyFCh0ysR&6dVp&eq0tSgUuF$_MAXI0I|Nwcez z*4!dKk z>F^i95igDh$}js})gP*imT+z^RQ6tNkaD%=CeY5_nXwv6Pae~I9;Ig2z^ihFEH}5F z6`IKY;eBhzS78pPnhG9QKvrDjU+oQYIUV71$@Zq2>Z}j|2aH>0xwQ*-o+@4r@Ytno z@n&pIzDX2j?Jn`5k5eS8J~v$unYp?s#`qHGc@Do2vZ0%Kvbx1QqDo~hMGK-7rYGDG z(wSGg$)Sx@ws$(PFz^~O>*Jdq6?5h+2{!5;@eoqw`?9qzv-78)4a`R=2dVsX*1<{p@sV|GWfKPj15eXR8 zD~M>SJi_$^vgH{q)mrc7^jZQ2uy{EA#%aWgb{FRxNzHZU196nG>~&#~ zMj4}J587#QS~$xe?bqsdV%9jE4eRhgPq)u(+)VIUa_i|U{34cHWmh=%DErs>vEVNX z6|0cJ*d{*ymgO#Lgy*DK;B!>n^;g!ilt6S%Hs(W)k>=*iLr-~xm~rh22n%7%c-{tm zc)vuZ0CA?uTkR_E5huf1{fcnv@c{w%+`6Y?-BZ2^p}T1>nSnd+Yh5bnQ7LBYA`dV3 zoao(_LEpA(jb49mpBubdnna!HmSM9^ zk4w6AJ-3`1SIwIB#rB7eQK#7zsOmDQbS-wQ0(UWU=n{dWyIY0LUZ(sePl$c9Zd46t zf26Y4?>fG|X~~CRu&v>3OBa6tD;DZIs#;!&v$yv*G3`+%2!&2qP{HnQF#GxWa&Pcc z}2!XfF@x48LcA-d|172icK#k9g$kR?*GJBb1;=-qs z3~mW^rmA-AR13;_)&X9QwRn5?weEr{0~Kz;<~;%?c@te=Xih(;M~E}|>t{ZWvme~k zUWwUcPXD0HX>N_5rH4jIIf@@uLkTshagfmy?^IVR$3K_I%>R~6NDnrK%PScN0^$4d$297c?CPUvXsY4wwNUR+ zV2rER9R#T9G!D@DnllCO%dmd7gRNWoMAWf|YOEFKT`PPEMqBvIP}C>R`U}0wgLj^4 zK_47K@tSUZS=yS%^Qep@)Ha_WUEePn2GhKFxTX7*2l(xCPyWxU*8(kvYc+(dlQJC74qyzcx zqW&SH0wA(O6ecAE;(oaTU5F`ryZV`&?E>+agsSPKet9eO0ORSz3)%%c4#@S0k7eEi zV8%X}ryG2oi^|v=I^Ll(Hh*&NXstFka4*l(i#I(Ww{T!97Q4G<1ZJc-{E0j<;H_=B zi33S+IY$dgmEu_TCQ`P||D-x~)}M$(cIjb~q#RF@@gDWN_N~pXiEe?< zH=SY^=nP4CNf|V@OEVVD(2s3D%p;{Y09&&uG*UXvwvoOdP!OR98+>-;po{nDK{hm*1BWR(tUxv9U^C1#2` z^3I_vEQva(U%)`Jd|E3+3S&0y!g_ma3xA6$eh4QrQ4qQulozZ*M5}M@+pu$ zN4e}*ZlbRJ=UkccRQ1dd|MllcwxjV)&@4E;$d)TrQ~%cYC2 z1A`}CoEct8nw01$QH}Di5>R>8_en59_~j7hV7M}PqpL?#vNY& zuv*yHUYg6{Er}nT+K**Rb`ps<^bx(Ike8(!Uv1d;yoWQs^h5RCg*^*IKntta>rFYx z^E$sV8VHN&f>1~uVAqqDhO0h9=6o)HKdpfp*ZyQe4#Lbu!Gs%SSdJ6!T@-j6xL)sW zzIdEdJB{zwvQ3=)?b-~ttlU3h!@Tsa-9%)BFTw9bx8X*{5H^6qvFeTRsP~UsKUWLd za#y*xA1WjZJ0MTO(8-43(7rY$#qkrm&I7GhIQ+&5t}zOMGHYQyel3YP&;+I2ieJz@ z2I2e5ApJaHp7GNBl3FLZ);C+;(<4E~?~-J!X(;|VSv>~r{9s|6k(j?0H@37$Q?k#c zR<&4F^)p@xPt_FbW-*UP>8uGVpvzb~Jnp&6dW~i7RhE)0aCNtnWHYaAb)7sn6OO+r zePb2(x4GFPDv(OLIC5^5*h0v9bf4d?Y2$evQXqqY7ODD+C_-A%q( z)W>LA_0IU(xB?W~v=S8Z)9%J%&?c~ckZu&l^77;J`3qU|8jDS*{;pvF zSDPOm9a0n*Hj__A$}eMfrbSQ~>PtWbh+a%E0dIcRG0e1IR$Pjaxtw8 z;hE)CD03QMd2f^##2p1xeE*X(R0i`6OlQumX)RZ_tgwseRY$W%AL_H)MfgZ4d^@w& zyoPX#`M*uru>P-1*kEc1Z~SMfB;BtulAlWs3<-F+ET`W*5}c9~y!m&t_AmP7ETaPT zQDgmiMhNlW1mXoasH&xfKgpt64)H6oOY6$3I~TitLln3gq=-bp4lgfzvA3)F+=_PB zllpr6n=a-{r}tfZ7|(#GhZ`&sNuwq5-del|qA)pqlw=hfyUS598&&CcB_|fbPpc0AZnR- z3iukf+d4dNlHhHm%ohcDZ~q^osbQ{Qlx_B=Fca(7yODP$KzI{as#vR0XzqP++Vscc z01?rPI>55;ni>`t$M3x3@M4Vg9uqJe&*r%D*U{nozq?&Mv%um12lsg?InBhyPH$(n z^;!k#$5eAl;fJtRE(|!TzJ0w4#^47os-B+w{DLFFhU1f21BTlXm0DOlhVaetj8=D- zlMB(P!EKz*%y=!W(fNFb0O`>d|McqWItBz?fc)gh!GRK=0Z|wr6GvvnC#0yM*7SY0 z^qmsZO}99#(T`gWpLcX_Zou;d4^DgyIXjgS0^9zo_X^9E@8}Gg9WwoPcnB`mkea)K zPgZQQrm?(0el^EbT{QJ}h&)P+Y<1abA9PM+ZmFo2^Njz+YOcRv@{qbgGO7&q?6c%- zt!e4Hkv*HT41W8b!bjYQJ8+c6z|O91Gz*D#hV~#uZoSN>*UNVQR|dOa1TPwopsXPgiNcL%5bSZuQe`h`ttf=6qMoE9isgy+4DF{w< z*wT{zEH6q^T3VVa!}Qe5HnwKHJ=@9l_S<5kL2wq=(-LRRsGfbTZng?5v%V1?zmG)i zE2f3JDQ1kxtS{vBk-Ou+tJ!!w>b4*7ehR3de_+EJXvcHEj2chhEWPWlVi%fw1b@^EE= z)j)k2iE`@-2WRFan@L z+?J+`e7r({hxdc!_hVEOD;&4n=gEc9LfOSfH`9bK1?S>CKdjMBaC$k`y-wCGs=K2q zeanzi@93YQ*VGKW^GPhRQK$!fiesSZ*!=6HkEOD4Lv-r*Woh5(8k4% zp1bK-My4xi-wODMMJBuk8w2dzuw$7-?|)H)GyvpirTFd=Bd+h)gS6AF>g-hF`JQx>L928Ho$JT zg)`jzoVlU4j>~Bh_71)||5kHJGff>?b8uiSBY1&Vyn>ngtWKfJ_?D<&`MPNzUnmtifzj; z5ai*=H|9^U4tN4*lkRoJ=y@~5lxg+=Gh{k=j&c>gp6uq>yNb|l9gQ|-YE!kAW4+#rgd;X3-N{m7rC5gCFCme5UT62E=Ljf7uE$R~Z%BJf=WM=a^ z`9hXw&AQBOr(JT5YU_JhEZwLNHunYVx0gF$!KsfmuXf2v zO%1Txjyo)`v0w`Qs;@$>#3Em9C^@(!^o^+1`?2{)u-}F?Q8i?`@>f&c@W`K5;LA{4 z>cOJYxrbNz@?`K*c&d5X8Cl435Zz>Zh|O%z_IRqD%1K1Lr{UwqqA@+(LnQ_>U$oRS z0Tx{Ao)UJ>p8v{z`nx05>K$7}Vq)!cOR(}HL%n08z9Yrk%4|M({k>@Q4fo`TjdfD2 z&d&hIl6(7ON?`qkxgDRsSW(;eA*V6nB;EB<%hfU<%Hmp2JIf~}+D5_tpwo%SC z9Na8#Mf8jpP3>;K%uHNYpE2~!KSbx22Kd-J{Mw%Vdz859E5t%iW+{(wtMgh7DTF(1 zw>AEL+|KL2QV-_)%lh;YJAc;rHXgpK4d~yxONK7AU=S{k*onp3SdAPh_>8wUi^k6VCXA7FV#g|7FRTSR#qu={@)UXIeAQ}U%X0rXL0 zhyH{yn0K?78vk=Y8&Z}kl?zf=t!GX(w4F1(eOz=iNwx?w@3z7 zU{Rj3n61x|dmb9M%~v*jFzn%@r(2B3f(E9N!>hf6j`Y`*GN(Q54cFt6)8f zuM<+5dgD#MDx=g6BWv?|OKHg*vl>}t(4j1?ZRM%G6Y+!6;bQ+H@_LBvHSwmGYu42E zuM(|X&1@l6mqc&4$A+0}>XN22tCc#d*xNio-$xDp0%CzIIU~&4(SC=kRD0+D@-<}FIhqB9Wlb)V*In7PMH*D#Nv;`L z=$BDZdL{JpO%i=pF48hcUmX(WhWUibHe0Fr0`sEJMqJ_~r?e$OG zw^HELC=r9h{cpEfZ|RB7EV?~Mm5vaXic9HLf9H9M&EB3TyEzKsC|{_#>vx5QuMCri zoNuxGCM9JetyqPx#n76YO^S$v8O^Es^(8i$cF@U@->(LBTF!Kf@SRx8fHv=q{R;DX z6`duRUbr=^r&%!b(l-5~CB=jy zw}zh5R*pzURUs0OgOB@MoUVGN@oJqN;}*>tXu9@I`c+o7y7rhNjQvLDd1HXzV)w)%Xo1$l-8O7LW|cN-ErgYagkq z=;+i(%p&8I7_5p~bHr7b=gBH{BYgYDI;yB3m*nNbDK_memeE8WLG&7Lr9MIg!tx+7 z?RxUJtg!Vfy=K;(m$8b|!rVx!Xm&ZzShb!Ss?{(gGu~o^uIM+|a(|-RaiwU}!AkxC z;=4bQR8(%L#42FqhpmXM1+VBA&gZ7DOp<-5cFqxMqaIr_Xsv@3J#SFDELAd^% zfcIM8rSHaDB-tTa`Lty9%pC^2#YJL!?X&tuiShgYK#O7OD1ob6MmkaB^zhAoVvbfDxRt#1&$I0Oh zppwYoZgW7nz1ISI@LOmxw8v zi$E)hR9r&7j;Q+$T0M=i^PEX7$-Hgvcva1kZwq>SNhoWjaBG&5949yFdd~7w;d2z^ z)m(2gIb7m@pm|RI!83Ps9rE4XO(#arZ8we#5^z>MZt%_N$VjMF3;45*kJlku&kVP5 zhi!)Q%}bC$$Tu#|X}m609##if)2Y`TlDyV)%5z6`p$MrNS1L_CIcUi$VXLYX$(-;+ z0B5ar+df3%{-4z;cap!JyO3VBdOs@(o-fZPoEMgv=q0PQF;v~bM!Qo&M_X*UvnFK# z?o6&2!pJ$&A$xKTSl%L#*$`Weft&GttG~x@Pvr=W2&5T)Y>uxs5xM%5N`t4o6l;>5 z{nUY(e!1Qoxw2yTxOE$Idu?+GkbCwtGdDjw%6h8t0(rsVTeHPaUjRonv7W`rwY?Q% zZJ!1gwK`(y4q;Be6CU`ngh<oUoXdb;2T>G8RYjoi*MOqDbH)$)O}lcC4b*n_e5ssqMUti?X0qGP2y=N!F0ms zFuUT?H!0=kRI_I#m(I7}sqf+%q1}s6%VB50+noD-dDiB@+_$ZRp4?z((Jv)gVQ@$3 zI^a{i@_5b6*nrPhh0*o(+Re6`j{;5QJ|2%5OT6VuF1~8?2k9g9tX&K8PrQoOjtN`W z91dk?hg*_K&7_>$7$?aV6HF1*0BztRZ=ErF{4m%d>jMVnp%8a89L;6A;=79mfxME4NhSk_rmMOO<;~lzvh0k?&cy`E$JKlDsrM<7Q9xFP4Z>- z0#}xKHeEZN=X|jttw82OdU>tNu&Oh?~J>#S-1X6cLSn4{a9+oYqHSCPo))?yIG-RhxJu67!pwK$p}H0A>G7e5!dB&^PY&V)9jbJO zbw)OMDw&%f|8R8D)AI^&*_Jge!c1!%ua;zQ%XR$h=ht2VgWIABXRmj(1t7AQJM^WZ zSc)q&3yob1c6x{ZQKB~nwRdTKYrlU}!PdSq&m4MF-pEqy?Y`9RYQUCvAZ)`TCRQ=a zeD8GE4?7vt?Y!)p-JkXQ-jxU2eE_Ca8NfRAa)l27ctT$;55RE+G-rS7enFUf>C zRbM*^|l=)h3+$J`sOYl#2(E;{a9-T3*kLv>8qXHL9&y` z5*ugUiN38g{IgT|w7~Y!gVnyDHtp?e55P5grUNJHwNp7@NfDT51fMBsVi((fHO+G7 z9o?0Qs2`lu!<3e_QU0?=8EU&Mokm)V)?Wc($xp9Nmj&NUyvj0P#HXx^6_x>ra43;& zqJFi{O)@R^`Bpe*wd&6l`96vMicJUfJ7LLk^ddBbt0Q%FZ3b5JwZ64xoQw~*E8D=l zRB`~59hfj(@rBM&ri#u_#rC=?e)ZW*jM?+Q4Ia@)>eOKx*2t<0iUem`c${+A^Hr(a zP2`+!I6xjiMlz3iQm}Eq<+eSCTCgV*Ler4Ryh^ZAVt>s~7d!E1>! z7^mkGjZ$yW`#$AUyr&`<0d7>^JGqW;jI3kq_m>mRwLVLTaq3FgvTCYB{`TumZ)%hO z1F}!sB;NQ_KGMOuh~t1Xk2$OiCG0^Hgs-VYU*-NwD1yDl7X4&T-TaR<{Gzlp>*e@z z_Dt@F5J>suyP5B;sc8sIe!;Ek%NGnnx8mx1qpa*Y3Pa*`;? zgiz`J)8+l-WVmQg{*KObyFzI~oiV;%TNZ&Tnk$p;Pg$+P2R2Q|+!D?s^eA$`JQAmBUH*O2al4JaByH9H%!r& zV!+?u+jr&8OZflf3#046>k(mnu2HzaLAudS!M^=3ak7flxz7Q|^}q_MwCDH}BI zY7Y{-GdsNB^rFZS3^XtiTh4RKRm$!KKm&@XM5sNR=DjB-PcfeKJp+^pBUL)})e_R# z8z`sOu0t!caq6Gu?5{{pQfY|RqoUJ0J6-o2f@KX7!_b@Gvl|IcSr6yUg9HU9%&eXG za}m~GqptqJ_6OBoGa2gY&N192(NamQQ(Xnj+FJx9ETYC<}Y{^OGP%k3TY$kN-!!f6$ZC(AlM>yC~NdT+nB z2>@^+CDp+FXY-BsO3xTg@fsIm$dLFD%+{7dT7;NbeY3DUXau1Lg7y z3j9BoNj(nRjnx3_c!TXqftQmhpK=0m7GiNCLlboKeQugR%z=%P|Iv)fWPfrk^K)Em ze&wqFVHr6sEZ5$?P{NXOTxoS&9U)*&S|ot;9B3~m(6Wxzm~PKU^Yi&#AJXsJ=OT@= zJ7xy3)|~%L+rfx@fUlq|2QWbfioXSlI{o|SiR9z6Gw!SVgMj;EYaO0olP~mDKQOjv z$RoFr!890CZa3=s>KbM1VT|c@G(eoa3vQ=76sU5t?0s+aI%reM_N>V>()IXhg0+6N zc+tdgMN8IuKkn=4_-|b2xlfNC^VHVEA-n8?hy`Wwh9r-fpT#6D2Y$@43Yjp$i^P`y zFTh}{`H=-^aLo6*;jvkCFOHIrO{>c6;IuF~b*>l4J42CsdIA8Sv^isNR&6xPA_$*) zOdGqpDq=>f;-`5;llMGVfoNDF58BCvQM#pDgIScuhDV26WUd^E;2p8{y^W2HX5o(| z>_=80{V3J@#v||QeJ%*!wX50qd*7^HfI%JUGGUcAqlu!MyJ5!(s?jU<@#psl?`O4P zjT8_bo#MxnqnR3?Z8VIwwS{PENmFI%i$HTarL5V`2pTE2%r7qLC&nVajg>h$`G0e{ zTMY_89rq0*!|RwI7dk(Q!B*;I9Ly1X#B67@Xeps!4)V#L%o^)Wsjjw(#p1v86GyqS z_k?^DyLKqK>dx{>1kq;bpf2GnmG12VCa`GM@_oZNUB|g8W2R)AxjUN{|EYRvgnH`< zlIdytb4qq^lny0T&1&tAaO2{zAMtKsdXXbnq@rSb&U)d3czs8RfuZuPAW0FcC#t2a zWnv**`+MyQaTH3L1G%JY?5t=OQXI3e;_Ow^(-%^b*DfEeoLrp0sC%isKDSCBxcprDwT-`W1L3jk(?}V?^iCI!^b~BF+w%Nk) zlkj?<=@G>!`JchWAF6EI>7%xHNAGDBUSH{47_tlzZ`OP9^x`scbuOF?`0JS!= z=WD(m&GVJVkRFN07xoU7vZVF*f!O>n@4_qpc*0Q83E44qTSsSb9nhh3<^xs2>Pkr# zZ=v(v=h8_&oSe{lzFB&NcDyA4c#L9=+h=31iS(q2xHNVe`zkfdFlBTOzRVcd zw)m+;V8&3_1GG6Z8bH#*4(hDS&9TyYpB-N8JCP$iH9BJ#@GtJ{2sIfghLB|cI=h+M zdAu&XfC(?zYQlp=6LM0Dwk^y6XCgp9fHS;bzN7HFln<_Bf!}`&f=e?q8>Li#+IQPR z+h_M7c&+spGi)KT0;8b6>E>;REA|dEINpeZR4jEAVa39JBBFQsI(~IZ7I))j4%leyslXjkOOnmXHnnNHo(gAlG9F;>Nchr* zE&;UK5@|_DzO6QE`$J1%?n?Qd$OD30Pv9;cAK1y`i))osgMe~e*@(sKYkZ8z&wqKo5$fi%+`rL%`(GAl zU=X%Y5G81IPUU;jYbOwB{(s8vd?r4>HP5r&$W&Z>jMn<~6zviEmWVOaA~U5qQ16j) z`H{Imsh2g(L{S2j{zX!#%WM$gO&38F5SG_;vI-vV4^Sk!NOJ>oS&~#hS6Uzy9GTM; zKeW6|lkn-0)IXl6H}skqgYODQymb8qP5h` z1nI`(a9pz-o3W&EFMqAGH6ba0Cica>eDrsM822`VRc6dl-?+Q}H=It(d0)ylQ-#ev z|1q?9@uqJx-23CreQza8$A5ogBfN~LEOGd~1d6@e?`({*nyd%h>~0q4_y_&ijFVYL zH1Mk2ZgCiqoK#`XP`9FwUAru)wBbocE3@gf>8}Bbu4dsuCHVdx4Ge4YF;3Ofv z>tFMKto<&`tkC(Fnawe>u@S1p^rk}LxCdw%NUg&@7`-8)#NW*9-Fu(c3#4GSbgO)? zgvBO;?;ifSm)vATb!1zl#R-|uzRkxO7#i9eWiuOYc1+k$%Ph;*0fP6*Wv1>(14LI3 z)qc_=*E0`V!86(#sH4?X)iEcl?E&dNlWowk3w~%-9YZ7y^1L)UR>$XIAxQ^%PR0gr zB20y0I%zEzUx}%lY9B>G?yuQSLj?342}6YJ<;GLkFhVROBhyhOBuFd<`_S!`J4|yH z>oVy*mF^DHF!JpmCQ(2z z*Riu&VJ#Q9oB|(kJRXacOMgZgxU(AOmGpPBFme2K881oKZq9W1H6n~+EAVs);7v72 z*y?*PeOm_Vs5YL87$Ou|TK^7p9kZpYv9Xwt@eeZS0`vRtLMLw#NG97Ry8Fo~F?o64u&z49l zvCK5Ylg$yuPMPGO#*6basTH)s4cjVXDR#@i=_n+u8jm}py!j=gnc_AvjB}J<^iNqN zU4?TzlMP=_SXe{%QAxY*<-SzEjFZ&%(&lAlmV`5z~+@;b8L94z^~|s%Yw4?8v#A z>!54a&m=1;389_kuv3N>h4HwcKzZtRfBcJA{VDhpqRaYN+Rlk=T_8dE|F5#Ij%w@sx1>s23PlPO zFII}TxKp4&@#4k5xCajoZL#9THBj84xCSdy+=7J!_W%I`1R4mF{@$B6^WK^@Gw+|Q zb=S%{_pZCnxo3YqpS|}-Hevc)Fw4itqDzXu{E1j*vSAg~>=*nI|H=SaDI>TG)ZRfu zL2$Y!R=9flYk3;!+yc+paAm4YjnvW%0so2K@yFM@c`e|=!A*XvZ)!yooOW&IQ#7`F zouUT2eU21{M1<{p?OTbYc?Y&JFIrtc!@H*-37}nQ{!KUgN?CojMAgBhOfCNV*GJG3D0 zG>`~cxM(Lg79Ku9IAG67;2C1rx*&cpw0A(TCtUea=J<#+8 zN-JTWC@L#1l{kA}=fS`P)m!(^B!+oZ&xB+nFCS?B4#IsoJsx>Tr!JR1V}0ZgyO_6w`Q??lxl(clb?rDhT2!x zJi=s_!Z+A9Z)T*YoWg?in&KMy&R|Kn zG+UF+W3d2uyHc`!IX}EwwXC{5anNgaa!Xr#$#%+cczJufi^CX#|MF?Z+rmTrO9=z} z&q|p8={DPK8-|Cs(y-5$>7S}}J2Q3|6R^Z*kB5ya-No%K9Bm)!9vubZ^v{b1W$W{6jC-idDVHRq=moI7?uGOU~hXEM@ioyHw_CaenLm z?VYBkCeObO$<4klT)9xt(H*X?c3a`SuE(*^XlQ7}2>&MkdR&;VvwC9w0w$7gAT#u~ zQ$y0mUuIN(wbdJWYbK+;BQdMe8>n1O`rXVkSofEpx0o`7%{9?iOUn!$(VIQ;VEogx z5+Vs+E56|9Iw!YaRa)HfhU$q^L8hNI2YQ^ZbXN)9L~?)vI|iv9d!fO9j1=iVn-N;< z%$pEqt#~T;jhnn(YNvu(4i7W^Z?Y0i{TLqEpJC)n3xt1Yf_ZO}M)hK;McdorclBM= zoj6STqLzH9R?2wyb?9WbR^Gdcjh2u~%T|5RirmOUkP1Xf_e|FjB>gewreE9JGHC|< zYJLPK+;xP`_4K=?>rbwgWL2sy5mD`!>-XnBt8Q8;YWlhJB>U5%qEYbbLy2u}8ew;D zZ_xfo- z17Nh0We2tH9`}(O7GewTyptIgbAyQkEjfYrd1OU}g%16PlPxm5Lo_xL{`nXPknSx| z6wLbUsG2a)1IBz64txHl)g>_}9p*FrI9p`bp#H1ceRX3q=+ex5J!qvYF-(8EG0QCn zvVB`v@_@n{vJUzpgOD~oP8UFYzg}F+Lc5$F%HJenry5N|s+@RsUM73K-CS@qc4zSc zblhE`e8{yJholf$SeyS*0bCi_L#@^0KWmaYlMS1}IVHaY2GQYqwA7Y`HYfzrp6Fej zWvz-2)m^13hwa#<_M~^XJX#V@WY@eP(&O{HV0S za_)LM=RtpU4Oe7^ozYX|48bb(o z`+rTjZ8LK8YZi&lJy{N&ca!w-)5;xhGDYpEMaBoO3fOER1{vi_t2_tpXvk@{A|?qP zL*mrR#kgN3O>FTlQ_<0OdQ^FLjY{;7a<|X9MEUx=yK-j{l2;fumVXb`|E|0bDK&J9 zZk$atLJPYrU$6Geg{RICme0}JB>T`Y7CiZLiI?fsu-wA4yNwbSrd7>l^bkUmm}a<_3<-zU2w3lt`)9BGXiBqPOeD8aZq%f#(^KxC%B>$ zDRGEdNK;jEP;eEzywcnsef0RK8Wjql{JetKH(o<#zjxm+{>9E3(>&r^?$I_+ma@od%dHRU1i|u zQ1iEuEr+bf<9~9U0wiBuE|;ZqR&c{FD1Ug&aHkEv9QucE=gmy_1n@|xra&rbfN1Bt zddl&0m&)Twj?mEli3C~-1O#McNG?vdvMxPf8L255X}&BtQ9$WWnAHhPLRQV}yeAh2 z5oJVj#I7D1g>rbB2z1QD(?xxgh(eu+L`Bpjt&a{A)#hE`KZn{ttxV3hr{0ALKrrha z%h<8<e?ZAs{^06%MCvYL(IE=-;F}(n$y+!io)nzI4$ua>w5N2Ic zvK~btPDsZ;Z9cnPV!>GRGA%Rlhl8Atum(AY?ubo;vst^gewX!!)L;ec$yi^@W~D3+ zB+C7X1n@q7>)6yx$|{pqPXPCnuhr5`^HlagWs4KbCUHL@wG@9 z4dxjk;S!C`$k={*wHDbs)%lKA-Lm`PRpC{S7RLG2%<9}xFrlyF-sl?ayTgss&$Y7L zU|+_O4Zxr?Ls!r2*nsVgdPQ7D^UA476CCGG@(RL&-ePW))q~j<1?XzdT>X`iTA6(QB@{gg*{hrW; z9M;&U!V9LtEn?2!BNqg*#$D_Si+1P)gnlH)zr<4KF2{GMSQ3#l%#w)3%K7z#|By+^ zj5>UH^#<84<@yVhrTM6+l;lhFBPM?F-2VK;Z(}wOVUt24=Fv5Sb^c4V9Mh~_AJ|l` zu4+0gRUnksDhW+Z%KWW!BsR9&JkZ<8ifsb2kuQ9Jkn`wmMffNjQle*Q!(-ZcwNBIV z;h$xqnuT}SSz)XtZo*W2+ zGC7cF?P%t1r>c-chMKdv$j0=Zc*mCJ8M|fQ8}|ouUrf+sRUAlBv!R#3tpi zJk+>+cm&kjITr;}1+_ILJ}h=daDJ<(QR|j)Yt{=Jj zp4F{dHvcioSHMb%+t6=BKjTm3BrTlQCtl)cl-}avd>b{cIpn;f7MtysJg7^FZha?1u|1;llprH5 ztHQT%vNTz_3X-(@`w2>nXx?cH9-CHUs`e-b7H|qZl@Wx{`t{ckG|U>d`bR`szD(lf zE3S#lz3o*lz+AXFbxyhX*%+m{kYhd9)o+$TQllI0MOy6RhB_>!Tbf(Xa->Tw!n3pX zpE1x%nLCNo(Ded!>l}>=ciWO#l7#TZA@fJ(<=pAb_G87d2*74ykh2sa8Q!fKv3QpZ zJDNcVHZ$vYZ=~5}WUeagUrMW(Rx6#$pT3reQE&9W)4a+r#Wv?b^&qc(?D}|Ywuwmu z`jFO-W|4}75z?+=H*HrCHm?RoWbf?>H5uN^)vn#xj@|1xG2nJrCE`ob zgsjx#hm3*!h^_lmLh_~jjv}a_k{k-}ysVItc8_0-7=ROP&gDg*ETb4HWf&=$=^$I% z;o{DGWkN)R;ugm}dbnxk^IH!7dyUy7z{3H(j@nR^zr=vAm-FJ!tIU#fSNcY6asZ{9 zl%S9K&E)qX(4O`Wy=bCv#a1D}+^m}q<~u5tTL%FL7b}>y$M1ml7)}Ttp1r+c?i^FY zc00dSB~?Bw_%-^Wv+W15hJ|ija&k-?+;5C_LC|R#l1dbG)e8+-qG5t)al@;JIbR>4 zve0_~&cmqi2Sp{tLI+Ssh1_blHT{(PyeFqT8ZPlNjx16_*Ofw+dkGC7dLEX-GW$`= zp$o2EMQ@)?Xc9Zaa%W&x!%p|+E1l-0DrnLa47vLpCr2%AF65+ieCuo8o#>oI%?$C; z+MTwZDgH>_X?QtPNv86H|w5<>bF z|DCC4jl`$v@Uy;I*=yzf1DKw!e@iRcR0OzG*E*;X=P=znHU>7?fC{go6jqz>;Ig}2 z8L;MBOoG2)25dtA)X2{am8Xa%XH!qj0VVfDXj-mw6dzIf?-~mh-%pYbO4P2YUi(ZR zNR;zqSrp@Z_+qMGIv7EhmEP`@@p=OTT!ngX-22u) zGsnvZ#A)e$tU=ztO|ZV<*1rs5!&||}J%jXc>EzVy{Dbk^M(-UrO1-`)wp<5acl~X?v6%oqOeb1pD%&)Szs&&>>tvydcn}hptCyNO&Up z$sr9j=0;jfq)bLbScKiLFX{nXQQV7Jqt|+K2`PIXq|EktH>>gbHJ4I?g6A0W3QqcL zypJTm$8GxquS0jv)3Bi((!mEbcVxFxpY2qewga4Z9AwEk`n^6_G30$R;3cF*CuV)D zroGl9{5;qzxD;IFg_v`@@b|^zP=A#~C*k7?ZLp8ys9wAad)75Ufk)4}hnLZrmMnSe z@=W)+m4zZHT(9)5#A7QqJc;21N2^w73cIK8yVR8#TLq2jPC#U*hN~czrVeX@CLa3~wB% zGOni7D+iPsu8g)cJhChXF)%VFUJ@|V9GUBxs*qktPM4`gPkYc~n)y}8b}EUZf)k?X z(59Y{H756D`gL_)(cT_3$gQjj=O+nG<*Sz2R2HHZHZP@a zc*TPHMW`M;F~ZWt*=O zHT+H1fNkO|A+oLZMZMQ_Jk4#W(4q2@>A{8}ZuK8jdHc{ol@serCt9JS+E zEZ90=&>#Q27??ynGYugeVhAO~TD4xCPJsO$j^#&Lf8R9sP3#k+sym56I^Q?l%_H>b^85$en~ z)e9NF(_VF!ps!=I&cO5PsuRrNEK4co;Ha8as4C{LTH%JjORpjSa7$`0M=W<`1 zbxAMjpy6RqtmUgppkAG(ri;L-9XXiQNO_unIKyp2N(89Tg>JBXUQ42M_O038+=}gV z@>frkq$}4x%%cYu!p1-%|PM)3~{}ZD_SEXg{Bnuf=deg!9CvALc#-jDhZ#7#nC?9ldD$IS^Oeb`3QnRa3Vxy6!&aE!n(-as%b`#^^6NXQQ2J8A&hP6GK%pMyU z;NBd&KwOvS0r8YD%&mnKUZsAai8XX*Oyjl9X_{jx^lv>&ac=t_*ONG6N!{jEaM+I? z$C)5kj97(1l(v+O%3(xyLE7#^{WZ*v^^a<zgyhv z>Lyye!Xrbl8i``LJHSS0wW_#A6@75ZiLI*^N2J1QczbN{GNgP8+GtIg`vOy2FIarj!$%QBl*l}Y>!H*I?x}7MX{r%?CxGOBX8476ITZIO)8B>U1_6td`JB4BJwS!cM$AJnL<}5 zo(0=%uN32BGr<@UxrHURTvFetuTmJSzBUyd5ADhM4{RDwmE&wi?tEXN!RBwB@W;<{ zsPR5ykpU-(kWQBip^QuK%3y|6YZDU_5C|0J7j}g-uM;CMSJKZFcu!}IKgJt_ZM40R zj7X8A-iaTHvFFg?+&o2_*p$y~gV}X*!#M>d^Q$RNns+{?_>O6;vNI6jnZD-Kt4cWA zBZIx}UU2}U6X(0`4Z7iWAkPkOchovJdYIp=tOD?Uq*3RbE|%zVn)IJanGU@*PDrj8 zTiIv<;2-WZOcw|0qhj+>fU}Q}SL4S(ju&M*i%no+vlO2(jrD)KOP6g+>gEUaHM z&;N8|bMt+3gQ}5T`y|f0Y&GoU@}RI{bYWp(dn{|d$_NccFK>v%0T8nlibi(gaL%*# z*n}1zpK0Lm(yw#uy*H#83PrBTDGs(};D{vSg7ZoTm%kopivFrVy)rFpNU5gu?KOYw z=skQQE}R0NVi)Iq4Q}}9i?V4;yCCt?jw#G!6X%&st5##TzPZ!XzLE5hZAel?(3(G1 zgF3sS3;U*G)Sw#T+NEx@=}er91Edp!T-aBQF0L*~WyW?bS!rqWl?L@f&d>&zmClX9 z_-4DQ-l?2~1etjdNX%=0v7XH&kmC7s5on4o>=q+~$m;@bsb#DRm zx~xyvoVM4sl05Xv`Thua+esZV7=x(XlL;=&U6S1Zx-8dTs}6?Muu7ew$ByF@ymfBs zp5zq?Dvw4;EXKj6m2M}lQ@{5<$=SO_VtaToLjSQfaXumvE~&g`)w2$JnAVTM6uVQB z5)yas-Lv=IDsPM*Rxi?Ob=w%olZzmt5#nNG#1YkOt*x)Fu0WFhb1N$=|GbHz69=BG z_p7Aw9Ky4tLL!MYTm1^3+8qaiG~!r0^#OcPCyJ1S@31PU%}v!cpi4_m4?kSgJ~${= zp4p(e!3z413tkS%)D8INd2{}byGSpo2aoDnMkbta*!^Aa>mM2 z>lNKJW=5BD@PVY5R03{mO|+Y|10USKzu+X4hvj$S1sMWaBaxhLQ z=@qwOgWYg4yJz4Y0-=%??x`};VBPcefhX^woWEFjx@S=V<#low%UAkh%iZ>N-gHUH z*6^`Exz?f_9(rsmM<;CKffc&~;d)+TCbxgAw57T#6gtO;euYVeRAl;iUq>~)zfT*f zG^U(2&1S$bfc`D5x~Z(yWbK)lQ{%pU+(fT{s+UN?Esf`sy2OOzw(35D!1${UZLV<} zcI~-V)tRa@RUcdDnr%~qop^E*t+X!DG1r5FEVR| zzbN!lh|_pfCPS3NPa^+4u;@2GQf+vIHzCk=k~bHRpp+#!)6D|R_hC2V{QdHju7Z_Tv{v;7wzH2Z%4~sV#AYD51fO+iq<7V zR@5S{tB^8nja;cJtuj77zU!MC`<$u24>dYEimOmU2T#n|ihypp!n?Wy6(@sauR_7w zC`)xjv%e?9iZA}gl$Gjex(qlIf)pGn2^2?RH}jYyN}QzTizAmlV;O&itIykSRwmqT zPX8w59F$Hef_*a9x>#%}WevGe=o<(ZB4Eu~X2IYO)KB5(2DM5%x3}4gXB}Snk>lZ+ zdJ2ftHwDyVs7n$@bXiMMuLJhKoUrTb>yG5^)*&n(&U_pl8fpa|QghS9Dzv#;8DI-k z24(q$h0*)770n?@9N>hm^+K;-X*W@T=a|d**Ot#Hwzt%lY?h97?M}wB=+Bp7Cu9Eo zs%akWokGu3Q&K5Z_7@!z7?a=u4?OP=!CDKS135kHIe0dTQ5_WcW zf%gRk1!QDo_Ftcv(7jN|`^dRTn%YQp=7+6d4b^-dMp4l7kELjtah0Ajw?fF&u)P5F zNMBS4MA0ZC@b^*rQ{MgdM^{HTK{_%|CS(bl>9g5TAEIr3c0|v+Dd; z=+nzoVd%3(-=i9C$|D+ad&)_b?ThbGKAVV6-rRhLa%E z`1z!f4n4WAxU%1JO93rTe|{k$V-8m=d{Y@2{)#!KG$zXQu+gxJBAQiLSeTbL9$=r* z^az916TrC+PETtEwz_ii;*=TprdFLGjy}x#fu^Qc`*NKALS7kXGZ!fB2=Dj|+J!mp zK}=QH2?4&3X*oIH)@ogbLTlahi9w!Y(*&<^{R2FoW!>vcZdTpWZ~b=Gkx4pv-xp$R z^s4kwE7=0n)=x5~{?RJerKr~}NKV;%8sBcat&!4dgQI628~;$josQ2{RJQbbYafEE zbxP`?P68tK?L+@G7;qO^d_@KQuME#|{6HNS>Y3|~yk)>L4n^GB;p}L<-2DbPC8@I; z9p^7jPxH5;g1S&wVYqbB=Prui8sfn^p^C9Tyz;jt?>4m4aa`+evo8kC*b-qmKLSDA zN5-en3voN5ik0Y8O2UhN5d0nY$0k-QB&oySsaFcPZ|!gS)#s6!*a&+W+r<-w$(5a&pd| zeX^6Cm6bK&^0HzGusELP2!z= zRv=6TWCTD!YGdJE4In@3Fm~b^jvydko&J76H-8ekfq?YSN(c)myXl^7KzhxK<3ewL zNVacyL?#Q`ySk?IH3qaxeHN&y1}a+!>{{B}wIKhrEl#k-H))yqJM`Rlc@p}Nri~ag z#&3AL{*p0ngqqkcL!Uybl#Q*9ujP})d!qn8^J1#`t~cbgcG#jU#?r_Sib{uqu@bQH z#Kd8UL0;d&g!h|#V001W&C;b%#1%`4?5@#9MFs|$&t8?pC%^GXN0PFwAvIoFT8Cu} zhHTA^6KcM@eog*}hI}18_+b29I5UDTXaD5eoVKMR7lC28YB-mC!~TGiJfKFNP;5`e zVQ*sWFo*YG%3Svd!bCl5$LBk9rpZer5?Ya@yACsNg` z+am95+5KDiIRM4aHfGjI>=hy#P%qwYQ{bC%U0fj!Ife}Pg!1cy!Tr!wBDc@S%?odD zGX}C4_pczu*Di6x?l00M*T9BMe6!bSCr!oM+X8?fkabk!7azd@b*+~+C@KtOzx_L% zjk{n|s_p#g&aPERZi;_cLyee+7&`K9sGMDpcAl{ayLy>P&0O$q;361omuygo?=u?8GZiLfFo<^iEoJPZLSj3`I?5s*yj@xUhu+fG^#- zLH02Vz18jF+?>F#4#}97QRpFFHu*;6Rmic?w_}Q0seAJWo^diOEwQ*8O|{HP$bw&p zgI?!~X*Xb6lSO_7{jGn$pRNT`SINcvYb?ZJ98PFs-Ema236(PXdTwO?@1~$vt5+4v zt%U?umoC0VAVfs?(t^J{9sh@@H0ocQaXHdZ9GH)h0mfeNpqa{C_UC`>8H7IYG7q8j zlU4qAPoW?_my7hxrP^wXeF1Z_y2I1Rj_=#kM0P`g*i_HT2-G4gE4$+br(o8W!NI`X ztg^!ROm8Xs^)LE&3v1N^p2;prTN~N+H!OIf&_f-N_agtBI4lNStbfX zzS-*cC8*YFrkx?od8BHzTtZx_Gf7bV#yfFTGS3#+z!#gw}g}Uaw=h{)>c4|`Jz!?e8|0_1@aYIZ*XLxyykwCV_vmh`i-Q8 z)f#Ha{xq18u!^)Hp}EV~yM@Kvub$A*?j3-b$I}5m>%#q_AP(s5Rltj9SFwsfm%`i| zM#iP?oLV$7@BTh^WG*kX>`KoqFgF;@VDctWvC$@)8q#B_e!t{saF;REL)f^D{DLEs z(Viz(y=lhggPwsCtUHmO8+>G#SMd?evt0X=1LMpcDoF2n_ir2p-w|}XeWEit9AWof z5f|8vf|WOY)u|M zu&WfO!0{d}h@oGS1%0+;`&ubfEbRrXxW_*lKLePVG2*;=qbO;=Ud$TZs%5p@p$JXf zIa|r>nuegpeAypdyMtQ2xn9Bbil$eUdCGioLaBBUi_OMy(I;88lX|;e@IgL$ z<0tgI>m^Vn5Zux>>QM1rjlr6eR&rQkx~a0A-pO`N70c)91hCRZi#BMvKSBc!w;Jea zw%@WWmC*7haQRt6v(6bYaZp6`B6hqnh+!hlK65P-dVS9%dT&j`^9m*=l6R2hzKtr8 z;vh9U2`?D9`MG%z!;CV znU!9C=i*#Elr;;s>RpQUw*bUFn)#61>^_Od+1 zhjEQ>s8+1fZr6nvZSomniO?cfHs8odnTLbbb}K3sDsZ|h9%rn{R$$VjAjsUJv53B6 zv8tV(I$;O~X)80tC@@~I&3a29ZVVoa?UJ^*)fD3m4Ck$h9Q~PlBC_%vRC<}0@NJy|2>p83E zsdTr4uwH8r+UT^kcYlJ3a+PW8SRDifHbAFO-Uc;PR)QD9(*#fq3DvH}L9vYgiy~;3 zRvd%2K;*3kLsdSy*NRJ(S~c-A9XBLb5sGN**9qJs@BkM;lMSFYFI-||#QbyR_&u}P z>DkSGKYaAoz3VxxUV*+B~yXj)}~=NF3U%3d!7W6XxP_=v6G6GE0932q0p$wc4wZA7%RxM_mDuI zI!Co50i#`!EW)S?0B+!S+Ot?wsT-Gu=WF73Bv%7=6$;{GWFo_(P{4>|HCy94FQ_ZF zS_oudjm3v4WVIru{+y*IJG2tx`B zkBmBlbj2-XX?Gd|J5s82t3L-oZws3Sx>($a`c*y-$r&P}qSH2&WRxe3xV-+b8VW1z zSIf5NC^wipj4n-vva>9eZ1R%+zGixoE^tKCwD)$Z#y#xCk!V#-{h|EY z&1)~)^+jL^XSUI;lt}(d%`>u*FC~gX<%T`yZl1;YGmaPUFB$ z)NCyp)Z%QeNpUPoxi0QumG(ExH3j0cz;Cm^)HP`%<$NnUew|bKESFej z=5t5r!-VJ0?;5Yh13$E|+-G?lm=MQ*u-$^VwCq*yG=k7%HC*eu=0_XLKzPcs)<4${ ztIU9Gt2Zi0bFxC4JPFV?KWStBj5tN#7Lfj2|d?&}+U( zq$J0d%i$mJVW8zKnX?74iT7Hg9G+Do<34H?8TrxL_OSI(Q>p}iH|!T7xnws zn=P}GY070Iv(UZUb_tHZ0Q4zskZwKshUi=-6~%%HdsgdxHK*q9cnf+}let=bIM=fC zqAkzL1pDhzP@G=ahq+lq;J*s;jpg-*0a_u--6fYAJ!1-686#lPZ(f5rRcJ^PZA}$H!f4_-z|DP{{uM<{93V*F2|B4t6 z4i)<6Vw`f&MS|$Ri_dm=|Mw8e{}rO60{-`o^J1b){~6+Sfh0G38i1n=FfO|-nRajx(mVX@7aFB zV;`?{{FEY}ul{O-_hz?^*~$%G#5La6NiVxRygu|YjlTg`$;=@Ei>_}&L8^ENOlMGc ze9cOH#!Wmt<3q0qa50>rVSu9#OntefNP=ZfcaT~a)rN2?7cEf#sGOZI{9Or>Mux`0 zBL{Q)#)DmGa_dVhC@b!jZlv_t3vs?7(y}F7zTw`dk01w7xp9?=@l`}sygb>+$H2|L z;i`=p>v=4oq=p_)GOh1+C|4|&AocM`1p`F4-~Xj&EI}8GGncL7!;36QvPXocZ@G4F zy4jX63Y$xBR7R5eMJm=arKGQZm(Wo4>*P3gxQ*45Ba${6lNVjy#xVLW`|bOkY6Uxx zUlKIqXTwktlHx8?d>&yDgQfQJ5|V4jlDN74W~##RVkhq8)?SQs{x;p-gvBYJ#wf&+~8Vb^k!#E>FJeoarv6Lo5(>*G(BrQ<&aM{hMkNf>u> z!R{T_^?-mK!0U4%_L1}oQ#KrPUAqj8I$_lJPKmI)Xu=*&jD$4gxt6D7Y7(=&v*Hz& z46XyQAsNps+BY4isVHR7e+j{lL#H5*%BVk}?m+gVPP0;IwIgexX{Fr1HHO6~eA0>F z1jpY?Hpv^KwSF4y{5fzHN$f=*w9G6wW`wblaara>i`V*Qm5b zF3fQXWEWsi*O?A1g5ndE^Gf_kc(M1UZ$9EqHF5w z0~;F~6K|buS>5u4o8P}I)&?;mu z*e#h#lG4>5Bx1@6xD3+>J)?7uPd1^{1!VLNWa?j6!bcK19H;3~PQooCY78!h?HcwD z)o7?=Ut%FPQumMOdGseM@GoCnFML-R@*oMtpZFbPq4B!h@DX16@8wCSj}7zYge88{1w-QndIpbQ-)HH&J9M(s zPg7 zFwCbnnECfiuJ}!`7$Wujo6E0s--gt{8jQayh#~kS-FxvBo}{Gj));;8UB7|6kM?|j zr2Cuf!9<^(k1l8I=2h8icZg5Gidx|2_TG8V@gX2W>UjWqsL2!~jC8CnfdYLy6VSZh zC8?7qN|e(@>52pNQ?8Mg8#ht()R@GGo~Z;hGvOR@@*Lih#is_Jl1)@I3J!x#!&e7B zlJw`&A1))xeJ=p{Y4y|fQtpXod=REytb6-uO2>@3NO~KXz@9qgIfGPQOVDCz8A8 zaV4fS5EYEqo=;=mm`=u-adLm7OZOhh3u)f%r*^b@%%j&K+(`bl%QOGGhYJ^NWUzrd?5`4PW@ z&6dN1&eV-e`O4Q~3uyqn+g3h&B-YV>M*-BiM3zJ;ZajKS+`NU9uvf zdwi2e$~uo60dlqXWQEd=U^KERO=Go;_fNN0)Mh)$Oi{i$e}cLqj~{Ar%s{KVGm7iP zd(}0<%Fo}S0an^$w)yN(U2IfzILn|cT-3<7>Mg2eZqNqQuCd`g;V8$RJz$QjVZFAJ zq#B`_dO44~?Dcs<54fo=?GC%TSp4cI3q(QyFq@76asTUz7?-}XLiQ7duQNpMxCB8@Sp z6mL5q68Mre{N^=up{%=U!-O{?__3-&s(v3kJv<0|A14~EF#bcYgl}1YsC7f}&(L=bu@Hx2W~Y|Kzbuar?|V47 zQ`;@q%!%wj&_=s=!uuZ@i}Hs)FW2Ly?+|G#Gx)d?M~qUjZAaQgsk=%s>Wot+q;7dLto6OR?e2ETN^U4SJ6%HtIQcnBLUKyNfSh z=Jkz3UDO}x!LTch7_7v(#@C#YPONBhl~?$!y#f_<+VW42SLn;|)xFV5|MvC%mQ>a2 zWHvMJHX{?0&?kq>U@`xLSU!WpvDhvm;ZkHT)GK}J@%~;U7#2O~Mi0W`6Ka@W>JRhF z!DG>bWP^up$6(adKp5K62|j<7F-YNndqqMDsFbo?URF1VUBW=4)WKYIXEfwb$`n`Y zVvSnlU?{M3ruH_5dI?jiaioM4+3c{3=zt?{kB~RE171g-`^3Afy%FI8k?UBSiB7$s zX_>N(9s|FaQ~vEW@qkO8o;Jnb{gqnHcK3f&*4tf?moQryQrCQpfRCp(q2Wh>8L4gzMzq#5bf&=( zbRzW43Solv-e{_j_IF#rL!}+hgi=n7*kfGX4jl?P$ITXke zST>}-<8hdF$4UO%i-oc8xk8zHbP^0iVq)gEjUNCiVlpd^q)D=%%Jp#Hppq zBMc|K=&03eKy+`9a!Vsj9D6K3%+P4E;S`7krUgRs)BM(ij>V7UB`vZgwoUIa8IX zl#?Csr%tBqjgf~V%|~elg@y`^fl+u<=bDIYy#MfL$O`EhCFU6iSKR@LM8VlN8DkN@ zW$?Pf95Q3BdvY>UEJB;?Tr`@gLsxIKAZ=T!f=p8!!`KbXX-`15mNLzNj`D@`HBRi*<=+C1_>+95nkfk+XKceRFjAd zS`fc9BcLacut=E^SX$5TD4ouTFh@2ua8bo! z|HiNdjv28-BARcTla0l46sNAb9m()HOV>&j+%Qm>4#nuOhEm?kave0pyf$$k5FlI{*xP#$ry%$|5N^31$d*?^^W4 z-fuzIOUtRw9{eoF`N|B-+S*O0Zlwjlu+0&c{B8V0rKgVsi_L{OUv1j}PloLU>&%vgaXc6)z05YCq7YetUDDfq; zD4Knp!2r!TDIHvZH;zLs#Cx&gYGV$)Zd@n$#OnvGQq9L^CLs4jE4agkmXSI25qX92 zheClP?)D6A!>tFAG#nozc6m;5faCPPWDNR}n}nd-;E%i21p3XWLDA+0=viRB)`Z}C zxry#k>2NR_{7KXH4GlpbP32%_bIKQrqvW|x+%+73fWO~S`hx3OT3S*ZorZioq42tr zTsf%Ae&PVvSLPqA`zS3F14WtNxwYXmdTX(`+Q1vMnO$VH!iv`j^{cqHBC$i>G7$Gh z=1{Sku6SB%imX2N`zK5Z6}VHD#~N!ySSwg>`PTrdalg+QZ0&rh?+>QeB~q!6b!Onl zXd^a~RnsW9_d?-P)z+Yc;NaY`V;QCgctT8kh`@L)G^L2b|AxEzW{h-* zkP#5}CZuj>jC8ptW-xsM3c00~1n!^GY~*k$DoD>`czPg1ceT9}=q-WBdhamP~!wn<1V^O9f@tp{UW5Jb_{4us;mcbM0`4X$gBAjXatK zEdq1d$)g2%At_Vv`%Ch8kx!aQKb^?(g6z>fAARH(3=jqJ4Pd8;fu@)0z;F?%$Ch7q zck)2tKZi9PoEOcjrIJE8SVF@GbNbp#r!iq>YZ=v=zH!2z%VSL69J%vtYp#YYd!I3~ z_mPdCtwQT$ECTeVoKqP*2{5QrV+Epd`IGytCBfbbQ6xf(O=haYOA=Qhb6okEpqsD~ z2rqCDIEgIbw$EKEjON@;ZSYV-v=*HN1XM&D^wRI>0{-$(zaUnSxG^HUx*sN(^3S5G zw{(pbS3aGN28ce|zV`TCR(iCE9%Ju)aN8;i0^{>iPi`?gG{fcG%<5h#k?|*Cwep<_ zsA?o_s$*!d}lRTsJgQW;Q%JnRBR;Gr#(7U(Mvu zMDQ_{MF%nXP1TER|0X@&|F)>-y>F7IeKDC3v=dR~9z^_i+3k{PdEg>lDtt>Rx=U|h zk4eb>wqJm#Cb}<}HXd%PGUL)t$NB=?+aLET%}(HJ1%8n49*Y-d7$Hnt&nP1PvtR-k z?L;f|t|mm7b;I}asx?UAiyMSrsn`5QPl|6}}!|NIALgG>J-{1)OzD8&BQ7ozT+=z)omh25Cw-Mzp5`V=ukP8lv{bY(S<>uwpy?4%Q?MuD4 zXM16PNoQy6iap|Dv^Dv`tIQx~>b|$Aq}Rz%(_G5X#AOemp6RAyoTv{}8`-&@kfQ^9 zn>S9lnr|iGX5sW2xQ@fkTZia+p(FCf#~sWlhH)>tcZeEvZTgbZTUi9X&Rq<9vH_jb z=UK|7O6WeJSUppy0B*%g_+7fa!J0Ci#WJFDi5JFP0bZ2V7BM#2X4!*6eH4|4rwIl6 z(N<`#nC42G&Sa1m_0PHoDePd$%eEtv{P2Trtvr@bM;AVqEqT?^cD|3<;2-4lpcJ#2 z2AF3W&L7fyI?L=R`0dU^n_LDp3U%q|J=we>>XIH!sx|)-R-Ql`CqJ~$iG_%@0 z5$*}Sd|J9_F)WtvhNrWb(Vm_X?z?R)2Ip>M5Gj)C8s*E=7`$4nx7dIO2cxy-y{IDf z4vU1;q0~iu7gGuX=+NB0o+rU)`Fu{2po5F-HH2FiUgY9iO!_ml2S?nqP8ULso5H}y zW0x!KhZ5#2TeV&5PoWM}`d*Ka@3=;t=%~rL27BOJwSeVPu^EROwpaCqgi8i*N=zii z#D+a7g!*zh!!xaf`oqyU9^<#}9mwpuYoybX0i?F^ap!@hrlj<$W_0ay&P-JTo&sjiq zUx5Y*Yi#_%aTog{pRdgK&W-oUF58erCAPegmiyF2_V&0eH*5j3k)~G5oE1e*e_)$^ zUu&+u^qpP8D*kA(*>dfYPQApQYvOkPx8hrDL-Iux}ugyz{nW zzic0v^G-Qq`8b1lDHX1F6#giI>=|njO@L2M;^-kpA&1tC2c)+#K6o8=fsbO>yHel+)4HdgR&r-2K6cae*JwY0yaT zk@`##eTM`N2?mEk*mrex-909CKVEJ*qM)Fx^O<;LF|Ut8D+<5#A_g|L zx$?qSsg2ExiDLlZ+sjmIelm9OHIOvsGy|xb~TVB-31I4Tl{*X@2=pR#|;%}BD8Gx1g9U<_X zy&;a3MI#}j*VnzVqrDi5r`mGu?7D(r?s&c-L9h!LzUL+Rs`37@^%5EU)^w$+FG_Qi zku@JI+S$?*EA+n>UP9yarl~t?yx$18cS4kD#_{FqE@H38eCrwxOr3Gq%YhGM?91I9 z4LNN)8>ZIl`-G(n4+CS=hC&IP*2|*;5XUf01zCKe_J(bR7 zns!gF*Va0>9>{TA@IMN!-$i@Pbr?U)F=#7rBmR(=#3pX z+fWwn#g0tHqy)ZE*^9hbV+=rv}{K|IIKOt^^sWvnj~H}X5nh^RyIuJ)D|%KpPU|^=^X_TSLan?KZYY%%RD^& ze9w(}43~Nl(c&Vn*DYR~yomI04XvewQjPNE8>yD2f`3}FDWUOS|1DsG+DVtzH7Uih zk37hgQiHKrZuQd+)Jt?9g;r_L{WW!XKh^8ynWed2Dt=0LFFdxE#g@aycPU_t+eYvk zGeF);Z+$WgSC`@GvFw(R_3r}wBMRgUBOcp2m`_bHRF3^saUG=p0KWsjPL~9Uz!P^b~^I76HA7ADn03f+7rM2`D)U0Ckd(0T0m|iwo+?C zN&X9X)^)U_Dwu^7U^lA{D>A1S`VQ1R<86kvOzG-*7Pn+JP!P&Iz-=;CLV)4tY-Rk>XIzR zeEy5->ni%iREWnh!Y-4!O!L%>R!WV>g@vjww1MV~17vS)U0QuRad*H}c#?+^^YyKq z`VvyTSQg-ZWNzB_4UJgNm>&a^ZGT71vPo=QZ>`qh)I=IvK{S;!_a}Q5KcZuvE=R@L z+49xb%|t6mpV*(&anSW@5B=lcPZtO1d{3U|au&>mC-LmhWpZbZQBX%>MZO_erjX)} zr7__L2>H>x#17a7nqtb{1Ph=1@#mr<00({0V6gGd0Xm=8&Z6S4EeQKF7foLhZ5^2e zv4&eeXD*O4sY$KrMZeNU2QjLeGYa8mIT3=DEb*&0;8Z*)2j&6cf8>(@37KGClm;F% zZ`P=))THBT_|Rr~V@*t+@2#lz?Hq9{1}(c^xs^3>a4ud%6KUrI^I=pAuv?Rf}Ss9(;BYqxmgDri6x z@$fM)Oa4He+E0xd{)PUjyUOVtZuG_hd@INcj|f=}L02{rO}1*JcfH_V zkJ_Ie$99{tzrxn|x=?n9@#kyD)!=xPkiAV7=Blzwh^)3WcUH^?A1#xSV3q>j`m)+X z*$k{QA4d4kq;$dSV!oTA-{eW?2P1JPy=T!X`WdLTv4u)5K6E`M!{E?T=mCX~)=7#` zo!(IUquDi4*^mR~Igz$00UyTm^?rg;hIOe{Il1j)d6A2QOSWVK-I=;xByw@|d^dL? z18*>?PD^0kw-FjJg{N`=-Cjylk$u^cAvivU)7}F0EAo27J=UanB-i@hMLBMKYM{kN ze#cqD^DXE7>eSj8Z$v?U?x7KAYA@DfZ-4Sc^K_c^T#I$Ccehw7Ssj0v6TC9*7WD8Y zQx}g86KJca6(pt;zQ53E4RRkWtLuNauvz7t@?b zrjA8@Eo7=r$Z&o-0 z?x`Ty9cTucN~a37Q9oDeEj}AhX0_zOpbV_+ZtM(z%;3ic+)JTE^ZMrr1@Ftze1_i4vvmgn>PCzN} zrgnE%-e@OT$`-JoB^|D>caoToKnRvD$xc?Tf{&!dWl6!e!(!tR zHL~31J!L;vFLES&8QEdHH3r~du1+V|alMR8D7>E&4kD)xMeXkL*;Flv!N=4<)fF4* ztb%!Jv*otuH~2}Msdw~2J^q#O!5(IL zvI&c7PB!vmhd*4jFE8Z;`8WF3caQT9KjHz0JjYNMtcE`j$rCogfCJ5Z*ZZn3NRfh- zkO}l{X1rEisi5WDn+3v=v}WpK;MKb4g1;%xcV-6R`i`P7|9suQ4J}Y7|n6hBfo|m^zs~1 z8wsSvFE<>`qckl#vfj<+g)%q{jH9@W~X7>bHxX<);GJ~xr z*CdB-2lDB;0v(qvj=#NGwh?3t1^uXQll5%~ZR1OK#*;3t0BtBm33| z2P7a#v1MdhwSFV-i<2RGPj@VnvWT^UE#SLZ?O}Cc^V-(>V{5rnut1*Jw&}~y z{#B*awR)FVR$D`d->R>t#Y!?!YnK6Ek;ufWXSmL!v;Yj$U7`bzQ1M`wx-Ypy{Bj9R z1adz+VbiSI55EMH2Jn&1<9=wOKFIh`+rx$Vp6hBJ!FD&>?xwswoqAcHB3-}qr_h)> zg_oCZHe!Y}WrIZX(#ji3$BY=9rNTdWXY^Zg=gDk2uFu=@K^tKaNN>0L2)KChV7pn_epP}sgQtH34% zWNZ?=-`Bugsw>2okk)6S{CvY{!#hUiDWe$rXt%3tAjmmj9w*g=7v+?SZ^*xt@mPK( zxN}*03-4FT1}j>C z;^N{`(j>Au*@=+@ z`#6yO#zkMP{Syyfsjrt90q@Le=lJ-?U1m6sc^NQI+Tc?%={YpJyw*!>t@$H(PQrn` z&>mTK=GtnGE6-LIJEr6$hR5>}z_i2!ukDR0OKn%*SnID@6co&okwY`)zfkgXOfkK@ zD4WNVeO043BHA{U3lk4lv-T#rDMqh>CMyu1>SOEJnuJ0>50I*QVdv^RQ0BUYIPIs8 zX2!@K&ZgxFkGmj>^Pw=Z@Fpi=eJ-Jkvh@Dr{706<>$%Th7x_o`J5M#qFAvhSgh6Qb zB@E^v!MmY&d*|9}Uk+g6M)0cdLT^B>;+IxujL6va;0b@#R8wAzKIc7pQ6>m-=%0R4 zJ07JPjhu+xk^F~Rm^Hja$idWL@f*eLRggSFR_gH7TbF*7rxbQ{tbi#x9O~ zJ$`Zp^Rks~FLvF#d0V64u$+TxX)&1Xcy7)XNdj(-h+zp}~&s~4Mu7|RcN%?hQn5=t!*B15q zApw4c>65uN_yP|*KxmY*J31?o+Hi-V8dV(_W|nnzN~m=-?)JD1H9o(K1T{`wp-=W& ztV_3k(R=wWbj+tMycA=-bI6Gylq}bCJPJGRrty_3nN}3iMAEO)184=3Ppo^Cbx0L zzj2-74L%hzDCKiR-?anZvm*1BYVO4odSNgpb3zt7kTuou2IB90bBQovz@hD+XwU{Y zbDfV}8gyKAS`g0{7vodg-az%|drR4fbQ)uZ@t&X@m#hP(Ch<$-i1BRs((^nYMSDu% zTJ({96>N%B`TPEiFSl%^SVw*dO#blZ`pbF_cMq!()=Wa{q>XyyYM^KZL4@#^FYPH6 z(g3#fgqxr5>F=Dez0|kx51(*)8-qyjq+0UL1>lr(ykJmoH$?UZqiY{S`1Yy&D7EsK zIh`*S?Jz#}?~>zq;+o z6DifT%5s-Pg^c37XIM!~UMK``-t7GT629GI%9qva0fCt1OJ4R1ZIGL$mUBxAq9IbktLlP4}sM;K6?DKq4hf%l-cy;-XjhFR|!V0+oE zJA@Ranyf4ML!sf%y|Cb>a^x@lC8F~%=pE}|@ zI*RA)vGDi54dQ>kL730~CwD0GI{!~Vv7aMU@*ky)o#xi|@2oVakjx7c=TrYPGnkQw z^?oEK&4nJs`Hy?<`o2ys^BaVE9LOgNRJuW0`_89wr1Kuv*cSd^x!HGQ1MxEx zMzFRQi5T|=c`DFJk>VeD9dDP@pyuy@*HYOZ-!6I9UDRJ63ky5%lkb#})BCbduAQy| zvi?iZjf0vTK)w&!Tm+$+Tqkys{b=`~(xCi|`+8xd+CrEjjDP&7K7%7m=XIEz*KJOnOh>8~iY(1Tjsa{}6&nw@Jr zfSFg_6N3nPt6lWHYm(~?87tSMSHmE2%n($FI+Uil&;FtjE796I4Mxe+RA`}AF6d5; zM*~5l7;sfT;@3c&BTuUJvm=S@jfT>4cy9HRv#ZXIhKD986lTO@0!fynKpFbq8E@|< z3QAW-kj=JnIfDjyVzXAV~@Oh z*l}2o+-?)v3;e^rnByKnb$XO9RH6{}tJqTxKTzKYS=7la)ZLR%qBT5Ag9T2f-K97E z_A=P%ZjP^ZyGMsxgAe*#Y!c<>B3nDa+}>kf9gJuDO#J$Nx*HF zAR`K#6mFqo+*cn=hB8aFsPt}_JULnYr#$Fci0$`xQgzqElAzANvsg~R8@_wESc^Ky zo>`0olLcNB5kI91bhhrtvL?)O1~KJ4$Ro|JdkZAOtWn?oa;vE zh?(L^9I(cV0*iv$)|tnT!e@dK2!+z`b;DrS(5!_8ZXcmT;n(y|i*g_n{1$kzSzs_& zM;;zmsj1+BYFC>Wd=Rqq(~h>Yo%=SvQV;Dm{wUlj=fE2*7_yGvw0)PJrtZ9o)Y1qk ze>gQ^?ALr#Pag}wTsDoG3(BS|@TMhV zz_yO$0l*oB&z3S^aL$msM2+EA=lrX5r4&38L9F>tK+Nfu!NmIY)#e9m->GM=DS`wDXQ6v=}zgp6!KwR$K>afjK;y=GEBrKQtkc$>SB6=b8t_=OCdcWKJPdL6v?pdUd2xrbhIn z9B_9$^z3uAq<*N-3(dnHt>Zt#Z6*nSIx7Kt(yY0^?bS4Y8*(}eb&%lEkE702O zXqvCG6cvs(OU0~FrX!ul!H}RO$uTG`4PIk5b?-P#yEJP}G4-%>jSvpE1amN9uBMEt z4bAZ@7=79}WWpm4=oVeW&&#jyP6qA|E7zOj@CGOh^6JaGb9tbK8Y#5u4u1;dLuEK~ zf3fg&!=F~R@9pkO@^6!4@kKP>enDK0#xNf^VN8P^(hU-F zH)YFZ7#mxXoD0|eUJ(=ge9^)zqDlUH!b>Ly%pXG+X=cMBYkm;yYALdt3~QktWYm)u zW$@o14*cjSqql=o`>tn%1+SS$Qs6VAK2KE1bbL_57&B&?CV}5Wv8JEF}0pDaJXh0Rv5%bFFO>zI!Bsrr5&tg zP|?U$B*3k!21p{23tK#8W0KAmdWUvsi0+QGd(%6_4`&rK+lX}-6Atqp{_XBfYBwaBZ~0G+Tv)&*~tOydHz4v-YP22uIthc?iQeM2qCz; zOV9*&x5C{mxVt8}yCgV8;jY2m-Q8XPdfxYY`akIIvp%bn8sol4?b>_IwdTCGoiCtZ z5)tD0)YS278yKF6`XuOd+e*J;7W9s5u51EB_F2IUMSvhvZ0PYB8vRDBh{W{L##o0| zN;Mm9g5QYOBw-4+v{N6pE}EFGDES~8vLu1UmCG5m*&rS(B7{`>*NLHHKq+ zyYuyMycYO8rG}*HdVqpbdKm-I*g8sLmC*PiJ7uBq2@`$2En3RCS(Hh`@F)P$&<kS}(5 z)|2AyfX4CpEhRUYm;GZ(CZEbbn(m95v}1fRxVGzP@^oVfgb@4eIQV#n9L;;(Z7~5u zPzyz7AY$gU2^M7lU9cU+^}eFeyUl=3;|paQpU?i4VGdfN@}% z5rxHJh@hNU4-)F+J23i;WxW$Gqz9k+=+pbheSe}}#VfP6GAf^|D|}aZyu>c)Bzc1i zSL#|6e9*iL6N&aC_(&ytb7z?5gd{5i&SJ6Xr*K@|fTV@I?+^YcbK)?kDIVZ&d4&BI zN$G#e@-msoAW-=XzU{_jegURm^%Zu8D$Owwh z+Ck`cF*V+=10(A?fas!jwlFI;i z?Z>8W0gQCX>?ilON*YVDfIt|xyo_6>nLqPrN@>&3V@XQCt(;YrCBLSW5sRiZA2hG!I9bI#sfj9QKI|KfcbkY0-OjP1#p3F(31s^V~0Z|D{lXP z1=KHZ65j|%#JjrJ*2V9L%746=X`f5;Ulk!+M3-4HL zRg7Fy3NXn_Qrtr5ogjzUO2)Yt@oPG9tYv-zr5<)GQX9N2M|F)W6YNb>6zwcyp-4hS zFv$DOt^zAzQutL0rj_h*^TU5cZ(Qn88~^UtrEx&>m4UOH=yceo}L>PDp57$M=g9?|n%B@#c{EzK`qcnAP<>R>8jAyD|1wdLdy1DPaEB)su+Wv(Xi`FmVxd z?RUm`lBgC^(-nk=+;e_iaQfcVUjOPBR(S8&efRwh|AElALp8bIuPuhL4*2A{G20~} zJfRLLEO}#vSO4A@N{9~!>vO!tL4#)KpxLwt8SXE;iYxfz)viT`-h~t}nELAD*E{Ul z&78W;$2Syur-Vq#)xKxB&KsWHFiv?$mnH~_@o~+(ZM@{L8{hIG8$14QPf;U(2YC#3 z6BoCi{eFUuB<*gkA4LbpDS!PvOb7Wz*$NIB9ZXvE3POP-THF>^ix8dW&;8ZUjJ4!3 zk#|PJmUx|woj*8O&T6_GvVRzjO6e`u@a1v1AXi6q8Q8ndMPzeEEzgf*)lL!(JT^P8NuOn7qc0Zq=k5*YVWrMx>IWUeu~_6?|% zG&y{*4L*2$A(waNvKzM7QaxR!kPd9%TNp{yLkT7#u(5c=Fp^Zl*(5<`)u#Sn@d=#^1ce|I1y zIx#kCOVj1A!q6_|8USz6S74^je?CkAa)t%^__#a*SNJm3jIKD z)pBGDq4&ayil+W~Gl{H7~TLku;_j~Ag>{^G@9q&;MU5r*FFTf0WI zVc-Cg7n;lYBI2kFu0&7BeaK^_LS;15@=J&#q(tNAi8Zz_jpB0HB>$RORmJ@3vwQyf ze6K4m4!dmj9=&+W?jUpi4e9R~X%WQF(tEip$L8o2vKQjSo0);~!<|{w9+rHduYJc8CLZqFU;jS=pWKhF$pFaDGz6vxlm&S9B*Ig>28CF7kUt&&R*EG>? z!SrX9%*JBps-^LgAY!gUF@SVs63cY!m`pLE%3uI@h$(rO$B#*a%J&s}uS2kcZ{FCC zV_-F7OfAbvZV}oFVAynM zNiub;CCz3vfa-MILb(K+np3aSe)!=vc~NhWKD7o>qs)pD=&djw>?6?b#CK-MBMfLT zuxWDFWzcbVY!`k`#sLqv3q4|k{T^FaW;GoJK8?6!%{qScxF>avPje@{%-#f zIYVE0v{h*WFs3`BpbKnsfky5|T{TDV9;=nXE59Fna;kmYs9jNcE(Szk&2tKba=Ikr zoYDx#u?OHHmaPrCRq&&98oF1(j@ZA=IJDNlK9we-2@L49A!(*3>qDcJZ?{F&3 zrQ4VDd``^;<4?^l7vfcv1sk(G%xmv%7GLR9UFAR9RR@AN4|I)p4T$OybK{i&)l9^S?@<-W+!LQ$04Ba|aC+iQR{g z`bx|_o`rB8*&?*yn~2Twpgi8BwTtE06G6BoK1}K7XCgEs<>e1JE}k_5{VuCZ3dgbL z3f|ktaY=;zhkZg{-n2QCx?d!u?0SZ0Ram_jluq#Vqz9u0z%hdWUIrYG9gLmCv3%T- zs!n3IelF1zFq=ae*&g zEdt-1?P^$jUHkD>ZB}uUhIRt(=kP?=4EE1N%nk61wv&1N@XH_TBtEu00L&a)}q6A~i>(6Y_i~ z$nO{MnnPOjvz*`g&U`vtZW|wNR6Pod5-XZBS?xuSXavh9 zpAtp?Nt6WbK%8Rlc?!R1E@{Kr3sqpN;Zq zuht{-@$cFy3;XuH3o(IyTN_oh9`JN@J&$_r`DvgkBVqgE;QPweOk-3ajcvjWD~-8* z@a3|H2FK72JwlZ6R+-vcYUNT5Uj70&+}aqQzxAU&4DndDXWZVkWUl^UsAltsT&jJ~ zj9p`AP8fA?JXznQ&(xb>BGX3Wr<+9I)ko+>rPT^Dx|Zafh12v*A`*&ry5V|(dnTS8pcA!cA>@F9jKdU{RyjJ^?SrwVzg6|) zCl6P5NP?S#E17@ZG54pa#L?}P*>yMUbWYoV26bLX{v&8@4%@&OFidr&E#D5w1$8_kVeDf&|EiMLc_VYs!Qs^O$udvSK@QTP6WQEwx9H%KR}KhJJ8 zV6ZQFUQD}T`g~N$=|Rb5yEuP+3q0|Z5G$$vZs z4Q=bb_%5PKfiv@_ny;5@GhxC+#onYruUT?NH4+W_ePnnlEfF2sxRCPUSi2}drftn8 z$NPu39`Z2FPT%7apMYKmj)V@H*zAe_;;?h~3)3`n0ZYdDRe+<#j0;Dt8%dD#Ut*Z^ z7`%x*6?bnCBYMaR$G5tHqmUq$>LPxw>bpuO_s*Sbg^zO;=C**vtY`y$EUtms_`CUpBf zhB%#_I3@hKso4+xZ4Se?N8ebp+n&rfA*Y7Xw_U$-*D#?1xiW`82yMUWQ;TKh-LIEu zTkjvra^*uExYjEl?@J*2SzJ2Uml@7-J?dX+u~oMTtnJzv!lJG_#rp~2u6!Jk3{ z$+r#1R6FxaKbWDH&w^3>AS&?9OBtu|@@vX_(6uJmg%!Z0=`RH|tLBi=g(J(&(p@0p zCmY^yzecQVkA3-17cjrZ@=Sn1s~I|jt7711pT1_z@yI&j%)^IK493*~UqI<4lr|3f ziST*1 zMnY3`dU|V3t=}OALUg-qsX9xY-O+GjHl@l#i_kjr7gnd4Z#Nc7xP)y=sq>MqWjIdch@g6KU^?UUSSZ@;meV6oe2$s1 z>E9~`psi(BgC_C>PI>DBKlO}hQBR(jhM~PZN|SCv>D$av-*n1F0%?7t(KX3PJ1%Xs zJ>LuJCLJf+LdMDiErIpD(DUcg4H&gBzlVUyj#{+u70#JtdUkyL*AJTw&k-@DYP5KB zE;QlC8RJG$E34tc*Bpvr5;1IsUwdve=f1!k?bY=5FK^Q9=ZCroYe6LEJ2~4O)UPcC znvgVPNgs~S1v3uzT8P}|AzM%Vj`+NOxKFpI2*O#AIPvAKzCK?#_hfSQo9gemfS^=-l95CHfZV$2XgY$Sl;_Iy7(l zLQ9j|nPv$!J0xc9&xGH`CqOCB=G0KvfuJMnTzMwUc-pcS3l+ST)t?4U7Ee|#JMHnn z4mb~|bEeOq4GjCEZ*81t;J@9z@0Q5b2WY1tk1cr82m9+VH z)jW9MZTzCGD8_(NEMXXN!np&<)c6hiq`y7=J{Wa7uG5I+*v8fDW#eyL>I*;l-;TRZ zJo||>(KfI;EK{gze{?VLo$PhxX7OA{QO$P5ofj*T{XRgT!7{N=dlVxS6qO0J_!M=I zGA-;IFtseSx!dG5$hOTC`n)35US`y`*h1V_>NBqN<3Q^KC|6_jtV6Zm&;qYkY|xc^ zdavYtrjlnfW*0Uw`OHd(Asna9PYS#Md(l*jWV+pLFoNwA6m3@|UU1=F>W}G&sn>cD z!R4RpvOg>#3dGO-cxGobvu!5mAid}C@52*pC9X{ajfNR$$bE^7>j>}Sw=39boo5KD zS3@49viZS;%1qoE+Z~l{*x7t+A$ZP5clt!Lv;J~T^`y(1@6Gha1Dknbf+$zaep-ia zd9!dDx7@Bxd)=i2Db$sPAjJk2xi0m*R2-&q@~d!e}O zua(wP+w8u$K?vz^ zI9wu{3Zq}aDP*ma{AJda21O%8Wyu?#^Ec6(HVf3~)=^I1k%nK3)KO0SpL}+GLFCZ4 z@0ij!<4`CB@0MhtsnG-r6aJX=L<|>$Vbj@*EI-D*c=nw`&B;-EhZr5tKcZ00fN84K z4Yh{750rT}_3e?1h|!a!N0weN)rbI{FUgON?Fzn@zb(86K8DZr<%g>=6zj7bB1b-j z-^LlUt}|l9%2q@ov%%O@^y({zq(NKGoLm?|c`ZLZvQAfE@-06B{qQ&9Dbb2K|Asi% zMdgmZ3{(S8Yt`vl%_li!3Dg1C0?0t!=D3A1fa!iF)G^;~Pl6i(xy*5N6C+AN??Bu{ zt*g72VGw)P)z(d+@&WHFRC&e7M2iI0h~Y3D;T2SlDp#o?ZDpO59d2knqg^fOW;Mri zEtzZ*ZJw=QvS8QE?mVlp2i%A&Gd%Y$3UTxY%_L}RdbdoXz=?}W#WD>@Z@Kw`85Z;bAVD2!$)jUY)4=Pz<4d>>3QVDB!w`hdvusqPnAEub=Z-g{m zn}c8mQ?i&SnRZ|}zMv#VCEDtC%0;RZA+LHzQZWnb*Z6w=kiQI=I=a*_-T89hI5p2! z{A@TFuy8>6EY?G94{as2vR(Fth!tZ;P-^rXU2yHAsiSQOwE7DS)}rrTm5w)Vao^DD z_-4~CmV6m|zB(a9MVC0U18v%Pz~dg7$^o5mO5vy&eTX^K2lbb5Pc3zZ2Ij$`RdK9C zG2P8a(ZmnbKYVLQmC8xH4X*YJO)qTgSbMiPpFhXzdB(f7qjGtW7KVuOwLd2#Y+Gn=q}$f|dO+vy^XyIf_4G;2>-G{wo=zZ3dn3_jvz0K^r<<%>n^sbL;K zhoXe;jY&3TRbdA8OOfs?gN^|&N_q0bN`G+jW3`X0R%`R?_w*rgE1&@j%0qj@ZOZGy zPucv4`*wUR!zeh?A2r}&%DZP;tQ&I0RFL7jGoUOYEJeBzK0&M_iVx(jT+5?ezTKZ- zPNVlX{BrR-3EmT2{>?XxtzVPEs1PAgO5!+y%ZF+wHnIz~ zp;dE^NtjN10NJ!?^pk*UHpaXSL!ql#m&exa#=Ia``S)E`z{lc+vO(>#ggk zbHNyRkSQ1P39xbbIp0OmY$Q7V`o0ih-P++P1}bLNId8NxBlVOV&NLIXM~5eB`>zL) znFx=yw@5HlUzTe41R;b5$Kh0nJ^`W(>TrxC=;SB_f_>(<~Vce%XEVU#t^csDA!jo5&EC zsl~Q6mhlPnNA2UJa&A&8GOshQSk>%ju}MBfp}Ve7JwMT`dXCy+wJs_j^*p;+<6S2{ ziew-ElE0Y5l#bZCtCMaBfumVt zo1!QcH2lJFZrkVC{$^7Y&lv+3eJLo2#FK0e1VTAOI^bfz4DLaPCradXgica22cs2} zm7mDMq4uQV==N)Hq16hcLpCd$SWI7Gh+j&3cdpz9f3A|A(iMj6hf*VQG>HC1-SWI> z%jQC#J5U@VZQ~N?%hpL~Z{ESuERwxN&*K|pp_f6bRz>MtTAx0yIaUM4UnAZr20d&))f`0Vb|-;rYjM@*ZY;kO2N9{0 zc$tEaSgLJSoQZFFZdj0KotM8IGS7~fMxb$1Ts-_jzkjK3y!;wuwaBP6^1U@1lExqO z8(v(F`$W`g0>j;YdoSGbs{;)onh)^ujX|I+wl@bqC3GR29&Tz(oCP zdku`llaoi}sUaVPf2gVn{RSWydeCRnUulKU0!R`(i{Ku~(hM*w^g;hJzV;$7pA!Hv z7K?hAsOGatJL8Tlg#Au{OZL8?Hoi{H_?rtnuHYy$$g$}AH~~>oBacDc)s)6S21ZIa zHUfoOmOB z0}!+M;DB;+x}T6}{u8wxJnu%Zq;01>z%~@FUL}u`d^L_`M)0s(*A``s)lt?$#Hr7g}3uQh7XUPlwLF_ zQB3byktL5lb|u6&(qhbE)zA?ujthh`i+6nbGW?|vbf(#c&L>vRlAQ`skN`xCxSvxU zVUrfYSy?3I6%|FqSMIG4=#WOGZh&%Gq7&kyy@RW3Qa|L4eyGf!$!W#+BPhLLjBQW! zc}*OmmaY|(Me^ZeR&YyG_I^0s>0U!DV?{76h}&)x<4yc)_Btvu3bG4Y^B1kxE->@; z61SB5hkkS|CUalE05-m|N1K7zo|?e+>*yF57_<_Dem#|XEfe_?D6|ld-{0*Z5Kh*a zYHHf{W8dqbY5{k@!aCFIYCK zUTq>qpS0kWuc}q!WQ6_k=q#jWTWVuy#J3Uux1sB`>xDbYCJYDtFLE+W?TF#}S`%8{ z@?g_aAkdCVR>239I$c1d4R#vH4`MD9z)okkSn>GceYcvz)-DnC{dB2ILt1d50~({d zP@GOm@Sic~;C#_TI>-Mb1y&rW%(HA6K-{#87*XAIDA88)+KzQd{5m=1!+^3>_+fMk zkkU3_xYLS@&tir&RkX|Ec<_nA01QiipRG_7p#1@Gay0<1;Kyv@!6?>GuH7EQQ8Z`3 zXrKxyjJ8MWfiSElipBxtuFK{^c43GGUwA_s7!cd3DSh*BnD)E(^d8!%FCgbgp_}kc z57hsN2I~Qe#{Yw8V8I)@Y%{i!kvTD7g^3Ae5?jwMV6nX=Ze6R-gwsl1@Zu%bJ8BW3 z&tl@#D08%WW*f;7Ccz4U?+WUp%WUFg_;_2$%0@YYdS7!UPsNbNLma~<&}ER4v!$Mk zEg4N5(^c_XtYA9IR0X%)T#+%_^>~idJ^P`@%aF3s%}L@ddHRDIACLH%R7qEfqmwdB zqT_L7KIdxua#1h~Mpddatz~q{*DiP!#oI|9T_7!ywe`X>OcXq4r+-(FV!jJ?@-s18 znxG{5jkq?Rc{Dy3w4BUd&rV0+0%+diU@tay)~e?jO{U!dBh40u>*|^KL@l$vDl&1Z z){&s~O!}`0>SMu&m1Z}Ix1rObOdOWh?tYSnqTY3PpLsyA^mc?dI8#qAs=LV33qK2$HgADuGAGtMD6DJZEe{IsB4n@9!YfCynm$QKuXpA0R7gDH4+SOFthF$2Hz z2UFV^ib2kjWO3T~&6|AX49dm|>B#8~VUs0(_A}X)U9sqrttMAOM0R$r> zHXAmMgavPOk$;5#IPM2yFpbg&oIU3Uuu~`+t$i(HQu^l4EScFFNk{2L5v4-dTfG2U zU$LC1>72i~fz?06wbcJo;dx8`CH*@Cww&U_B0TWP_%dp#v0C+n0&RpQV9KsBfq_*gYj3WTxY8%Ox_ zbz!3o8Af1*#c5iil^2AGmVOr!P?fmI-oQ`DNkSdHzScrSpDZUjZT1>+Lo?51aWV-- zB>!Zz3hNHJ%EkDv65vw1bTI|@mrAp=bF_9dlungUR~eSkr&dQBY>q<;cp18SI2#fY z!-4)dh9d;-IIw1GH%iI+_jxaPy@8>Q?5J%jH_sp4)Qa%Sg;Sx<3rG9tIrTygw|f4< zTCk1pYcS>7uEY{!vT%Ogf-VDZ5ctleoqjh0g*Ry+}DX9oeNxFZ$p#YI)6$Za+6<& z6K)rZ9?kP1Z#{4e>IVUo*HT+OK~fBz&w29Q2C^t9DNmZU4zzZ9>qApeHnzPJDpV+6 zH4`)8>P0^y|GF!2)r-NPM=01I;nzG)P#Q|Ye>~j}cV;9lxEpF1B=Lr;mDSfgs{ar~ zh#R(+Yu;7m@tJYR&_DE@1inNBfZ{AJ5o&xjb(q?`qY%7~<)!S)ZL12q0Ct+iQ&N+f_SYKJ`hzl;{np8qNS0j5%P7lt+6LX# zFT!Ep@=?a^yl;h%SIYq}0N{AIq=gj$`j$dPY)d%S6%Z8W0DK^0V20IuKIscQ6`C0N z9n2{I>S$p}Yhu}i<$D~qVY-^cQ(Zz#cPr$dvD{Aq8sRxvRU|1|wiO#-lB;%k_5@WW zAdyg?bjFhKU)X3;w3==vYjwNh2FQjlR&EqT5$QA8hPQCu0dto5XLMdL38t1e3-6g; znkx7K!QhbbJGs)`tzh3aN#tw!gE^Flcsa`rVWc!VvEniwLzNX0hT^a=T1eOibK)8K~wA?n;6M_@Dp9XoGwyO0b`;iO1?>! z6^%)MAa5BFW96B*Wy0PMfB9@O}R@TMz(zOAv=m06~z*>v7gGaKmoMrMg2kUEBf@s=c?k9`KSb`vU`}K!{+ohxfWe^7+*g7VGi0Q*yhVS#Cyh9CQ zWPRt1sAOU)2Viq^Gd%W#r(I68T7mpVRRBAy?Y=`A(? zCft%)_DMQpVC&%Un5U(hjL&^3;%>B7blg<3;-^is9FBT3M$u~`o-dA6t3|w z^7YQ2{ZL^S?vP7oEHy=ev@u`>`R4p=>jP-=gFKVICnhN=D!-0nYrGagD|!o6^mVYy z1i=RO^HjX}Kda^a!`gKuZ4dkV^`s0z+=;$Rm5&x#Aef^f$8jE zD@C&a)Q&b9x}F5h=uH778G9S$?>~j}d{{8IzpQ)%M5hpwx zO=X9V>IrLPU2v|NV%|TCY*SV)BgSCbTz=I+1$nmNr(RlG@;VO3OkO}y8Dz)22Yxus z!Hd38lYCu=wJ45kypvMHyM*r-n09HX9djT9iQ~tmSQ~vTtG#giMCF+yHxmf9=8)AA*tvhO((jS@eheHzGsJz=J#&;KZekF zN$V|zJb*^MiV5I$jOxzKy@G)#8X|ey3$kX{MS?xkOJzzHzK(>3M7|!S{wlBix-*dA zu6u22UoF6dp$?5zYc(3PDqI42R-{>RFC-K|#u$k)6FKrmx+Q>D5M01q^jma)E z6fTUcTe&FsD^U#eErOwH3$pU}D|-<^%i#F)q%CUnmlUP=JLkzT+(+j8?QG1ew&J3j z2*|w;4DfG+5aSGa@Rx`Vkx8m_X3^|6G*dn^I=& zyD^{jA0fMg_Y29L^q(jm!~z=;{rbP5bdxq0g#T5h|Gz|Cj1w???TEDN`il6tX!ihJ zVjzPQXtn77Gp!Jo{N3@zIPX8<)HiZ(|Ni$h`oidU8sFD#FdVt~m+g0mx93?=VQIWi zxF>%5Axs}K^)oax3;m-}Wpp%Cri{*VpO2q=Lr-t|62{mJeP9&Og5U{weRY&f5>p?i)?ZgUY89U6FgI8ZYAJY)!JHk)fUz5Rv|kG+|Lx;{Z*!h;P( zJm2a-GEv82bKTaLMhu#bFb*7s+o3({Sl*Bc>lZF>jYU{*|GoDOfn-L#XbBX&jgx6b z%`zd3e@C&!S0aobP~0Akm*+^rbu$rEm}M3nO^{33lf!g=i9((V)^M}k&_=fbU8li5 zOlQ~0Vxf#_2JlxH^l~;9!gI}~E?qPNI-+z4B4ZtoIU^ZD{LwLWJiRx>O&!-00dZ;Jv}uIpF6LeOJEPRfzU{`|9EK$A_{`4H=w|&7Jki3N`IS{?9wpvs(Agr8 z!)^vYEax!fM%qo6!~QHZN;zPBIwwV;CKWq%!3?GRl(7gE@(%;!z*(9B)EjHfKFJ>q z0dKYoarwJltI5+{S2S-H5bJs#20a@UkH z8WE9o4HkpQrUK>f+2m^H>ad?3MzKo&s||tIA4?WM&;Gn=R0^%G&ZUSHB72kw&EZ^+ zTduh}r~X2ePpmH5W~G^WZTmodd8&?LyxLqpkVXA=L8^&VnWdZ1vCAQngpQu@JZX7h znVC8B!E~iL-$IUi$BmYJq=$Y_SDJ8JOO(_BNAUShR3=WH$N8Ctk3$F1JjI5m$rF?B z?p~Y|(3s9vS8cM)2y7TXR+7|he}*M*vvzO=uP_a2|Hci>Arl!m%RbO-V*spQ_GR(M zv4ULPZPvl~r%!Ki=fK&IOR)orf2Rt9%oTQ+cbH~o2h~G4nL{SYoPMl+!69qM;&&U7 za`W#D*6Kr{w zHp!Z@q7QKNL411t)o|jOVhd(>oPp4QvfU?xZ&y4wEUr2`O>8|fjn;7cz(4WcoqGSH zv}z7*40S*A{dMZfB-CqLlWu6=MMpWQ$F zsU`({4|v5_4Dp&yu}N7%~4LgGVJ z)xQEfoiy(HzOu>zPZBoXee^dw)%607*oKqG`+$y^q-R5^f;72GGmJ?PUd;H=-zAde z=6IQC?Kma>YZ{@)P#U}yUAQ?f^o%J8t0>iG zAerIfs@{_~z8I`?_`V(9Af)0D4>$F_1uh4{wP-h|3!$|qxFfP=x3VkaSZ6c!4_5l# zbT_#I{E4m$;i&F$xAm~J2dEs8Xq)vxAUflonX81DQUY{tU?i;zUF$YOi- z4>pp7bMH^~wP=(hk3BCiceH%De!ew$Zd+ySsf*_DQHKl;d$Ul9Oswg<#XtjMhTz?! z&ml$&#*GoNlmdq9<-%?;nG8FZ2I{gU_oXYLF@j&yt|*n*4D^ZdJPq_IH0}frrkc?E z-(bms8yLFsGC#b|DLcqI^BDJ5V_9gkkx{+(xevEVigCNUl&cd7m1pD1 zq2z|^U^FJtAyzetG^v?C5VuA5CrS6zxpUuS`C*Qcwrwv%?vdC$b7eK6*XF~ZQl$x= z_IAk^j&X`f?rf2BoH^uzE+UySqUPsH=KPyNV>{ZuvG5sFPHw5D)sisLi73QPtv1(x z`4j5dB+?^_7vk^&dr3;;yY|(vA2bTBCbM!gy}m(n;6THCfpM6n$DIiVAJSJp%aNAf z0WnX*qz1mrQB@PlgCXWN574GXr=F9Dg~J=+LNWa0(Qq@5i+87Mby(>sbb+4NXUNWi z`U^N&;DTWz|X%^9?mA@#Ut54lu_>Fb3=pxI+Ri)1H(N>0`VSZ+;!fDhGB2ddH$Dsjda`^^NUYhL8= zcVrR8v(8=k84k5Qx<&nEr^76MZ!Y3Egs^d<<)?c#O%a|`_-P-_LZ3C=sj-t~iDM-R zvNx)R6&&d&kSHW$`#02Q^CtV+Y~QhabFKb%7d7?;etL5$QhG>Wv~FgA1u8iWZbPd8 zVIrrREBnKef+n5!NXl;qX?7!{;eU~NAM}xCX=cHXF*u}h*g@;pX01%<55|^&WB)8i zGiqqJ3*hISI4Gvy)ZQ{}1edzev-tIWTsW*pM2nJk>Fgb+uNPDwfc`FNoY*r0+R#9? zLBApN`25#@3L^aI!`zH-_rLD+Ffve!AWLf)?q?SI~vhAsf1(<%3kF~s7~`fLo{-4_@sI7Yl9Cl6M}YbatnUB z`}hlCv+}57ftx|Ojxci5HJ2DR`GI@)ThcNRVwG94j$Ge|^gTNZOe}9!?mrx_uCi(@ zRf_T32PV}M64W*uN{2zvZs7BwU4-iAC%s@>qve>x1|695Ir;9!(D$<3hzF1^QkoKV z^wJXFX9iv34#7Gq913uc(zox2o68T}LioRE#;qH+cp2uBqz)6hJQ~`Fpee5WnzE*Z zdQTCHZX~YfAsC#zUG8Gr8~`>SC>1=w+WI4xJ*NV6&?zWKg5&3o+RkKNqzSIn5Jy<9!K!kv{3! z;}@2u?AOG%smrrp_r+&7`>30b0UTb8W4JI{4=)JHbsO|QIIys|MZz06;+SNyC|JxG zFsD{Dx}6}3nW)XDV}}bA`y9WvMmWj(LS(dsvh2EqKVv71@0wNLNPszNBph;KEz_in z9`dtoQ+ihu9`obak!LiVv-x(-ZyGi;<|x|J%*lZQK&V|KI(?L1EwvoRJBIHRPZiG* z&#AwTIk(ODM!;wF&5L*Z55hiZF5|wKuFbAN&cMqQLkj7Y-n2}g;7eFfZ`2JK#0aIR zcoD9SN+Y;&e9b~^~&*?oY8vNwOP(8Xb z^5!M)PDQ3DDHWPG->SBe%_zPk45-d*j2q{%dC#Eqp1{y^B-3+hseb&tP@-nM($NyN z>nqB@Kc|U^uu3V!lDx8n{9|=)14JlZEw=z1Hjbvvf|B%-+LQpA(gU{T^>RLH#E&){d|0{m7h zwB_t}%~kU+Ja@Z&q4u%eRBv$1V9sPXiM#F!#g9{N3=W*Nw)nB%BbKnD5%WlZ<%thZ z;D+xo=#vq522C98;fCi>0z!~_2bqud=UE2Lf%&rdpj`C&e)jde@pFtdzV1{q+`^Oi zvKp07RK#;2=D;u`^PXK+l&oKPTZBN;6e`yg53^9#UnIA$TYY94_8lUBmG@ZI^!x!D zD-M>Tw&cQ3#fhXU5f!Ck`BxGsRKCo^8-{Tc=5Zm81j}6CZK*?E?pN$2O)Y~cPy{v? zOQ7^;JcV=njrf|Jt_Z?Y*7Z z&Rbg=K{seBkae8)G#J=NXTP#ghbT6**AuurU+rClQOs}K=Y0p~k9l=G$fGp`fs#x# zSG$vSkEkgQ6*%sz(;!1`WU?$laM`U%}5r-abfS zlNHg^0j0g>g-tW-B~0u|bdYK~?{p*Y!ler3H4LS?Vgg2HFRnKXAx_gjC136BZ!P(V zgFGRg+`=WIkhRZ+#WG?tUEpb0gW+g7-9hyoS8RoL2*&*#((c{rgyH+=_JQ6R^V>2y zr0c3I6*NWw@jyhqwd3WAS-3`5gm!s*(7ky>x7Rc}sLCh|NOTr4yw0khDr9)C0&HSt z{!#Glx!&VppKV0n2Mfd9HK=tDM|?%_19yYaLUkz>e0i(o)ZNEMKc&`6+wQ(+n*LBP z(GH(x=PqCRn^9*0q1>Iz`C8juFFm*{De)$({Z=Q+RYI_!rrfao%M#mc3dTfcr=_T_ev(I$*I1{0xxcyGhcXjGxdQm zcY7=f*XT@wMRfl4hn^LS&WSm}i54lwMwiI$I@7HR(IZsLxV~-q&MDC}i>FgdwMnb4 zFD_#Sghkixf%Bnj7n+TjuTeYVDY2X^p1%mL;LF9wW7}BA_KCet@v(3+F(<4ZE&6i1 zbigNb)*AUTlT!x^m7K+=ZE(Hfk<(fq&W?#9D@Aix@LSxNBp0Vh5fL#YW9GIv{k@;( zMg>E)e2((O_U%fwn}v!`Qe%?^>AEWt>6^LEy7lS3$LrvOmhR1#%LUQP%>#ZjEPPo- zXFeB}=&1iQ!I|a;3m0LF@xBw~(3q>Deu(n5e(XfA51M@HW>Dd6LL1lrWDgc}EPzod zW^J5~bJGDCmi4u#rjcd{=q*qKFeA^=1QgDBFPB|s?Gzq5?n2I&-9?|_5tkbXJ;z(3 zlqu$c-;T*O1%88A*5#`LE`B^CGA>0zo!Cu-YT1^g4PxE+FeDkT-4$_2!remjyH-bG z?DI(>H>V`J*@iwhOCQ89N-^a8#dbaQhd;qz1;CbDo_;`W2{dP~>#V(%*2L#Duq(+G zxg#x+Fe$}veUn}~K%61kfUBY$c6Ww^#(M52Y6DQH^mZ_vEm#Nvs-NxOSHmYH41rZ&50=U(Viy{>FfN@0 zMF*LC+C@rsge;vx2)gz4`;!Z}7sK+fOw(PY>UH^S)_)MiWX$?&^~!kI^2J6zP8qKH z5Ji{%?v)yFqS+!2YV$hpnXTY)ds_J!$~^)4fhN%6g3p>pUm&h;4naU-y9YUmKJVdM zMQ4Vcc(zOR65HF8;tlP{nZxVU1N7OsI*oOOi8Hu}0K0#>1-^xa%AugRa#?AU?3I%^ ztDgr<@==H0l}F+_&wUm(i(?A%{ECa4zQg@s|7d>x3lOcv9&5aScuAQ1j_^MBT$n_o zfzHkB_g1$uv+cFSU16p*BkU-FSoll&U5NEywVdSh=>r)C0TzK-z^s@0R$bloI`s|a zZ!h1@GPJFFR2^*BJ-zNA6BaRFO;{$c>b0OBxg&EEk6<>B8Aw_I?dp3wW=t&cuF6kp%2(S7W zF*-^~pvT(|YcqOA;K-b09v;Ko;JU9EQpMcGq9XH(QIK#B@bM0x&$C1Pc16jfiaCx| zkN%T@_Q@9J5WZ_UsSssY$PzK%oId+oI^eBc%;^qos!;w-n}^dc17j>4KPEeA|9rpy zD^bB?-iH{ef10xgX5jbCD4o`Xz5?vpZ{{Y#3hzX#D|{Hbt6ymzD{_3^dVF2u``??L zcSOl7K-vq*mN9+VF&CRt>MOO@{-JQa&Nm2nw>|0D?f6@5D7cTOMSejM8Kgk(l4hG1 zTq;}7NXM+V51+}p+pazC)>5$e-I+e_3AWiWB$N5T2N@Hb=(2qqeAa>(lfKkgTKipL z|9_2rV{~O(6K&A3(=j`?I=1bkW2@7#*|BZgwr$(CZS$S(d++zgc)wnLos5mO*4}5; zshU+aCj>Qh`8NY^B+qh;Pa@D*v(L_OFc%gy2@F*}GGDxDo5L&xs6Wsr^vsYa61UAa zmpU3qar2uItvl7COJP6gdPRv>@rwdBbRKvGDyIu5Gxu}QsKjlwv<|s+T zSr+_a`d`s5cPbA66gxMv)ks#^kC~#Y-cfx|cG7dP59xn!+nd_!c2U6yaVQ^l2f+VP zY`bXZS>Mio|5ND{wQ00dlWzYH`51A%yc+p`LKYVK1^{Wezp`q1BL98({#^|kze?tB zQ;Y|~e^4^!M={rbXK?&?ulxTi+s3gj{^yDq=wXk$K+x}CfBR*=D~cs=ie@tf3aFOA zQpPt&B_hAQ*^DYvE@2UOYg)j?E0D%XSHS))u`&hd7fb6!z>diM(Y^|8N7MhzN8iLP zy5^rj{7hR75GdzJ29oi!_o%Hz3gX$fajgO(D?+j zK+<%_75DyICiY>Z;3}OWfBmzOB zz9*$Wj)YzO)MQXVzwbb zqgfjuES7^kx(ptE=dvMH4S*PI)PGKKNMg3fi0E*OXmxtG@i;`rX?4ISi&*!|HNfC1 zneV+pJ)O!Q)cr+`8zqAj;Nkwe_xHO36S*R&Ec+~Z5>-`z~8p zT4%`kEP@AzB!Dnzw7tz9(JF^VFZc0lLAg3NC?oj8;GHj>o|SPR8Rwwh@v<)T+}{^J zl2=70O`1r=!~|_}Mx7nW4DAA*9>I$c%**wnJJy8vWY+zK341?$`BX&zb&sTIp$1{Z zsFu&wm>C}5IiN)8CM!jhcaAPKTxm#DTV!d!B4E20JWG*+M20(}JM;8smg}WI#*!y- zit;2_Ze1DM0h)3Z3qrtRgs63?VOPi~yy|y7@&q`Opkt~>K?{Nmf&Jeba|sDco%-Nd za9RN!+@g9bC+yDcX6$2X9~-0FM+%!@>h3!)e;@vb2?g{FTP_kj`~oC&Xh5>_J#XB> z!5ac%*6aXZ?lgf^Y40!%41>Xn%$$WHI<{#2pwjKg)!7;(xB)d)p|N*58n}BIedjl2 z1nyD|GcRj*4QsJ4Gpiaz9HihPL}aMQ$)$5__3jJ>QaZuasR%tJR}_XaGC{#1K0Q3R zumqW^^vTw6DQRFn-gPVadR_x zz29Rn!pkdsOjfyjlX1P?+(&q4#wDV_G|==cTLV-}gHUP}4Db8+b;>^nh4hyY8Ug_c zqi4?qfZ!rRpJ~HIWbSQi&twuj{DWhY>k07_Jy`;nB0!qXC*T7?5upp1}tiY&GV_UP9_4SLOYRNxdF)8}T z;QvQ)`!_?2nN!5xlM2larijcASkXb%wYC>%hqY4!{mbQFtL+5(s=CjdLR?F}!l!gy z3ls1Guc^8;rQf8VU(w*S{1ASc=+3)6RTu635Cj&YOxuN6Ag4;~?0l*f4 z%4~EIC8w{=?!dNu6v#W-WY2T_t~JSb7_4|3{%satJtqrX$F!#)G#W}G$`PD!EEOSp zLt;&d1reFkUnr)m5K1;Ew`e+iANsU%Ntn;STcG&Sbw~rl(YB-Isp**rzpufDCWH@! zKp9vIYeDp$8uPCR%tx6iSD5N~$`DPYO{ceAFrffVVzy=D zaKekAr?3d&#pbg6U>j4bMK4`tGiZCHN+|6viq@Jk+QX@i^7`ru$9PzS=F01Gt4hCK zZl<#Kl-K?C;k$F{`CFg6O|~;yfl$&B!05uc@p^a&;4-6CwF5{20_R+0imE6d0_t=8 z@BDG0PB8!?i7G6R+{W*La03&e9Yb0}{2Yix9lvf@if<9koCCITIdnHRL=|WOChx{G z!kxaL4U|YZ5XhGs92Uc?BjbHK>jzpMou(G#%#$twDHldQmi<5$zporcA`OUr0|vb{ z;>m|RwrAY1cNP%$8U!5wIN|fPXnPH$F~4%|Ks+KYDp(?NeKe~tSW~M;^;-=v<(iOl zfe3Zdj1Mn6mYFU;mX3&eLRXQfUo#^(Jf6=4oW!=Gb&?!uVme-O$UO3hh#xqV1s0d{ zHwoj$-v02~EzN#hta9a&y+uYvwVmN@FluMq&;+A2hP_GSt;)3DxBQXR%XV3Hf{^A$ z@lQBIX;eg#-965(U7+a8Au6%M){N@@0?9WVUPn+;9ZZk@c! zH!X+qv^l|G#-BE4;qiG@RatZ{*C0HG;zS}&q+5D8bRkG_p^-)&OjnSeON>wlVsC%l zf3CE`cu~gi!f$PgvQiT2di!gotsAG?fI~Xw_yL1AWT-BIg@_+5pQmSJtQ)_wPFM;H zqeNe@elEL6x`0!jD0*go;yeCyblf;Q%eWl;DH~VG`IV(VRM&7FB*{4n9q++g{<(#I zSO-xSA+mRhrt*q1Ex$6?TNxBXeNTzG>(#(8r*8-;V`{hA2Rc^Dy@J5BEcFD8X7_=f zQXYipe6;JbhMW|z={l^!JSAP9KPTEa8-=9a5@A#~Bo!eBT-C+oDW4XdzwhkWJ;dda zA|%xG zb+GBgyLz6BkK)VcbH@=&*Vlo`MFDv?tb>TturK-WKB92lS5&a=k|itgY)j--N<2sN z9t#9zR&KB%-4a!xoxwF8@uk|;*T7r%B%3sE}-Q_o0!l;Ht4!0 z>H-NDF{)HJ_b@4$nNd}fMc7N?bTT?qv(D84p-4Jl}45Zi`mm4;o14x#MXlw8|7 z%4mqFf8xLkEEj-4chR|X5oZv#JZt8_%YP9iU{}mc#WTDbEev!QhuWzOCd$RqOXz2M zV=pQx`m6k1=?2o^-WOd*N5Bjw)eP>)o+f!;;;iWkTzG~~*YNA~)GT9HM!dmQ=UwRH zkDWMx{E9q->37^`_z1yLZ9#@6V;brfxv%9e_V*yeQ4`3bx1T0h^?dKYJ9GI`wXg7| zA+YkXLXC`JsUcW1XOre*9`~7N;M#k+2lbA05$o2#mV;m1f3qA-^9j^_OB^kG=_8B|C@Vhk@8~j5DJ7-y|Rf z)!1%j-ba#SGdue%ZRJ8lqN88o@0`2F*Z0L*+u^*O%E}iymj0|V-KCkSyiGdx_5sw? zX%Gu_`lau>X|i*`K3Z+|GHoo{@ZL(?4}Lqikr(22fgD}&NIJO)JMskmUcSpWy>RjS zvqyjqHoB#235h3Y*N8yv#Z3Va(VxS8jRqN6`JE+tzPK3o$7z7SrZc~9BbA18KVdf6 zghtl@GriEWZit5Yh{G&O*efoEEFL>pYGh9oH%^4NlvTaGIBoS< z#>^Ekurno#Z!sEI|faF=vnL%q1)Od{3d$XDwZQpJ;>LMudA6@WUwKfWVdw?y7 z0)@V|cGu;gzG=P~8tAy;o2*-UUN!uo#y|x#(HZW`4DIshwfO=;%|F#0$i|(G7iA4a zqh2>~!8x2W5o7mqMA^Q})voE9jQsfa4QGWze=J1l%47;;c*Uvu*gVM;Pk}z?WU}py zCxR!mZvwrgiKh)=;L8WiBm|4hCFo$cXvubMcT_uHE_klco1{Zrn#(>M;ez>8^yAn}!rgODI zbjHS-U#%*keN)?sIP8!7-U+%wV^@XN$7>HljYzDtcoZtGUY_!P!$Z6_{NmMxmnGBB z*c6d>wQ>T=^A*e%UDUfhn76jJ?h!`l{&~)ZaGNHZOw_~{4j}D&9jOQzJ2xp=C;n6bs7XD|0qx}src-+N^*Ax zUdB=2s^Xt{sn6hE#R}Al$1Qp*-a1XdO8=M#yn+RKD|1r(AiO+0KRd;v*olv;nHpY= z1NTTWi-?FweG|iaPL^s+gZM06Sq@OyeiQ3^b!>Z6sVNGwe%KrS`r* zC-;il4P;^HTw1+lD>TMuUg&1qPJtAU@cQuq_Wd7uFIVi7Djc7(39=p3g90G%~bV*EJHXs<*%mf<5yh zWqHcg^-GY4%ittK=iVU@)cPD{m4BZhMO*zC@)Eu-b{DT2=DfI_`%KC)r0dA&RvXx& z;{lH!vk>x-E3irZ9bXN<-<6Oiu0Q6>_@S=LK3PT?BG{xAn7D+bv(K-E^H zq3xFPfN$LJn+w+f7zg=0o-pkmR|CghPcBu2IF3PV!r7t8QnvE?V=90jxUn36A*&UHDL|8lwoK z}Os}x1(+YeqAyLy)#%i5YVk_<20!gI8ni;5oHxrT5sc54 zLmC(2U)+3T59`TkD`mfwt`@P}VjT5nrAI>SktLtgC4)F!*jXle(KeiA240UDd~mSn z=V7;A98SDlFtC)=fVGYvBG4L>Hm0&TnrQ#L(@=!|z-J7txx^ohxoK%P<9&{eGy-_% zWhX~r4t3}43h|@>D>$_0HI9;J^mthN#bhmor+?|JS5(!7Q?^+Md2lS`bENPw+2MGM zf5{@Dluwj>d}$ggeEG=t+Ezw54p-u!80DvdqI8_axk>=d7Sd)-gR;5oig)Q^9HpFa zymLdE(h1_&f&*3ehg&h_OMMV{Y(%r#a>HI{?0yIL*bMsc!2gWuR7bSeWHWr@G`E@Mw#aVjg zJu)R7y2)QXKecuVdeRci`+(SxRqYlbrVagz+S3k?n9 z!Zdi86$s#0dRvSitG$&m)%IdNT_TBsX?v;>U!h`M#C%Y1X=?#v-!3($#eg#pYhf@c z1!BwA7!f|AB27D^NG~v65qAqw?k zfH!{8`?YKp>{mKK8pe|mc3-eOUv3M@Kn&VmAoHj=r#)hFVDudR;QWJ_4$PjW%)iMI zRJgNHi2lr?04xqSs=PX`&5ZYY!v=eT8j-YjBGloG-IA4Kz6rrUC#?xL9e^96DEc%^ z!z|RE{`Tm0ee40p_@Ia1-+LQ$#+U-zy?;lX>zAUHH$YI%k-Ic@uCprAjAAs1n(YWa zM{dFLZ{Zn#Q1wuJ1)yMV!T^N;c}BC3Zp42@!cY1GBmTjZi|~*0)BgpHi!hIs z0T|m~RCx{&VI~jM6c9i_5(uSFg@Y~&u>$CpY*)@ay{-fIV7s5dy;Nw}1&0u1T5P-^ zOsHI<7JPi_9<#oMBgV`oWGI4})TV$ih}&)>42eNtw1}eSHUH#dO^(6`sA}MQ0oa|y zWMX}oD%bh$el>4F{Nw^ldWQis@yol0T9M#aca)DxsJ&Qk4OA?Y;g^(@q$SuJ+yW>f z6_SgM{^{hcxq&JmGFcYkSD#St^xy_KLEjD`pBcxOFo<KbxDg3<@8TI(H*96U2M;>MXgT zu|J?*$A4-SlrMb9oH+hCf>1dJqK&Ner9 z3h1o^fpWk0YVx8ttjl+v%RmnE{24NKlq~0_DqgkLlE}l#Fd)?SIq-LYOR8YC`GNh|g! zMopc_>JDTjGx&UUB-|azt6$rIBKPfOs%l@=WZILxUAVTMVQ$sGd6vT; z&E_(4y?ylD_rr5-BE7Gt>uQxXs~$x1kYsP#7l=)oT843zqu-?$vS>Y}p`j6q$kW9va#oBvJ^gNV}XO1&!`@z@i?yEw}Dw1MWxgPIBQOV$*8{`6ebk-eXMu53U30cda<- zlP%&8$h7wDwjq2q2Ka{u_$3=Er9CKuOmsjT;N6e`Y|o^0?6+e?;4fDT(a`s;lAx+| zMk|iBTmduVU2}`UigVI`OQrDPXgLeYr}oXL3`$VYJ=)ghI3ko)0Ew#!9_KfEj{P8o zR|UK6;9Ib^cA&MczT^+P6W@^VG`XCrbX5_B;TBrNdQ|Ax1l!?6=3;rUFdlm-@6iO^ zc^wsoZU%hy6mmoy5H{IgffSNY=p_M2H_3+zG+7p2gu>9fT~Bz{7*hz+T7}=9C4g2| z5d>nv!?T6HOHh<;Z}VVF4&HkaRnAsD8nR8E1s?-DIWt)UrKgL2^Y?6htWfv zugU51yDR%-&w8o%5&6qB-xoQ`Ve+}EuV@pGy%z*57}X3QEh{ZaH9xsQl*_u^CKG~! z#0Qr0Pq#XqiSW*911(zptLjWbPo6VE(2%7hvYWz55;*Gm=j;-z42O|5JKA9P&qaF1 z3chfp@^+hOPjcztb%+9iov`apgYc%cyWksh>6oYvV4$U7c zmwGQq*_ zDA+3&qMC^wV{mbzdtvsldb*T$(>R~Se47dv7Jj+sbsn)|0&bhl5TPtob@#e{|0apm zug)ceNjdz!zqp>>_R$@-TuZnr zLRX1BUhhZY+7h|&VxrGfe>)XO_i1T&G30?S+l}A`V*w$BT#F?adMcnI8z|>kXLc(x^f8Bat5N zA|Xa9(wSbxz-~r_kNWG(++!w|kfkoz{rKMX&;h$MZe(K~^Ozcqmi&AMike>~kpy@E ztO^|N06_TyOpHX!V^Nw5V zB9IAzj#sT#0@TWkPBq2b~keVX%1MRQz}ttnm-smTRSt(RuU6M8F&i zAJsi+>!>2vh0`(-G&v=*qU9z>RZeO&;Tdq56pE+3N5Wx3*|1d9C4Ds5qC8I3$O&%> zUEKm8pRph1fetdw(IcSa6zv?{%^DD68?LwkFC0OkXo2+3annc~#*aiiB&f54a{}ox z_tVyM_TL!LAQZ=^$lnz@B#KPlAsOUttaWgKcvYM?Vt$I>nT-sq9lxll?JiWI6EJ zEtlhVKas?K>2$P*FgT|sN#9X`_u;gSFa{+bz6i^s{UXxLKwu5dlDQeS2|?`_YQ_nB zr{mjjPiXz&P5bgi%S%vRR}Lz`fh%X-^&RIe6(vwW9;B77Qvgqqh#sIG9!~T0dq?2z zY%dbV7(w^AtQ+$1RL?XovYY6j(CU@{RUpg89pdEy-z&hbm!8;zMBvp5Y4vH6VERhi z8ds#*mcQAGa3U@}(g=9;%J35WENvaq*OB-t-R4V3m@35rGh?AmY_-j{W!b(bJGEBb z7X+VoYlHF4Bkno^EO=bN@5X!k>Zl|rUTTg_wG-YKnvc{^`FyO=NfHKHtZ|5Ey$d(b zKJ!~Yhgx>}?+o2t9~Jr^#GkcS_=>`LhfT^}m(4l9VlqFkV_bon18{oV0j|Qy6+Dxp z6@syfO4DAWk47dBefi24n1oC3gL)F{OHQCjodNyTU>q(SX-F4P5&o4$MD(x0^4+Cd zooqnu=T(HmeIG-Auu(B8k^UC*v$&MfNGkQsN)|75 zw6C6HNCq!LIb8kCZqq>aVRNrT3S*FCbxl(sBnn<)rsc@5PWC1DXupYua%ILL`nIH# z?KX-lc3EZ)r2i&pLr<&rE+WK@4M7UjiHV9T!iVP2B2iOCd(D}=$$ve=;VyrXUXlrG8Zb=W=8Bd_jxfgUUg#P`~`qVzZ zz`^8<#ZLqxcR{6(aO7xcCEe`O@)hvn;gVe$YNdL+{%fAP3!f{^(kr6HUct$ zH!lKGN<6Djux_+7Mh3Zf4?-Ct``-q@qUGwK(4OhKl5;ubIGm7U6gKe1k~nX&?A6J_ zRIvia@$&a(q{>zZKI{=?j)Z%?K4mptJuzB&vCe6p+S=f)(iXG5OsAO&1`5t zPaFGsK|T3JHL#(exFGjK)F`b*9X!wyt+W&1X>*+RxsLQZL402pL^u_}aEt?c^3gW! zuw`~vcPSFS*z>9Fk`7sw1ww@$>R%J`bWFqMnvQ%nAqwyy_@m@a;|uC&OCXClUHEv= z!mAc-`=ia9W(9oE-aX#+?S&8O;eFDT{IKt;ElMm}Zvo?=O^MtXE$W%VaBBbe`xherzZh=oWg`|Z!!(keF#iu2L_^)IIJrsYbV8%j-QbapHpn6gF?ZI_{w@e z_~j5Bk^?88=Ke&tH)o-$!Nkw9lcn1mJvb;**&QbQL|bL9cq1oz2;m|gzgEWEGoG|3 z=a?^P%z{Y9zdo(N+sFeZinWSrjjOHdHgk1IsR|~{7iW8|72>QN(H^4DD z$S@zorjjst~6dWzIn0RfUANwD4mUT@ z^SW8JptoG-)8#7ocW=$$;ANX(Q=$k+uP4H;*pK+_eG4Wu^7Y<~BCcb8-W4o(+^zvx zK!JA*yeJtVN9dSjDaC*MCfemX=7Hp$RwiYy zMJ<0vd&KI%;0>Ptn9qk?w+r00GGd5MXtUVpmfx2*crkivtQJ}?f1DaD=g{Bfxitfe z8&>6AhRb+g*V7mSF3dPTe4Wv13sJ=7*1DM#cUGqM@3`pHWljyFeY0YE1s<>ZsRC*K z?Dl9AU;SvvmB-5fA6^NcN?KuU#)9eYTVU{(;eMoDOsT20F4w9ro|gR^8S=R;2?V;* zpDNjD5G_bN>oBi<^zk9BE}Mq3$Kp^pF6vfi<#aOCwH1-cgzM|?$LEn}StOr}iBvtz z1~7Lg91*1EA0$vJmBQIl$8Epn^Vl0M*GUpRd6k{sG0{rlbE?x+&=oqNuRZ2tZ>?^( zp1@QWE56{o!?oi*h*+azyG#_OE>-hzRB(=gqT<1>{wD066Z?|K5bb)k+Jf@D@0uBs z5&PhHm-aUV-VhL-@sOg6uG~1PM9Xqd@?l5G5{K^T=y6bOruLxWi#^f>l=reV*!5K@ zZR&WD9_IuArwE-azJf3XcU-{L9j*@A=mg`yP33*!*;75BipF&HR_AN5Za?miR=Yi4 zF2(u&Nfx;w`U}9%9L@OPOX0!dKO69zZ+c7-!dfb-PZ%-VcY~X+v_akHnS}?f46EdW zvRs|ln)sZ|=}!#%BIWLhwz>VhLo^l`3e1{KUlywLA5ohz!6(&ek{ycV)6l>!l+6r? zjEvM2DCA_!olW;M+^=;500GOwfbgBTaGV!RihID9>E#f8prxyb!%Nhm*((Y^Z4#P7 zELOW}BNzZVWdDU6Cb)q=T)rI5sL2r*0M$bS^G*wU`9UfwTki6&fZ*jhZ1bygftg$i z0B-vyD;hVvb0O1W@>i@>sGa_}Ue5lU<_vE-LZQf^)91J^U)9DF>Ej26Uer%(~?uHr=9A3TVEa}q@UG_Flm z$lHl7-szBgOMdJ);lsp@g}0g!9m zWE3gn?2IU~NbQO%CU0^hs)Ip^lT@m^LFe11X^nn+LPD<8Ops(`>hczCd=ei*ZhR+$#+@bR~ycg9eE zy!}eT`lDE-VT490hJhn+tv*HRamj`qYPS+Q=AS|>T@r?IY+oInc^UU_9N-+|1@gDB=?j+1H zejWdHYPKJBl~$xjH59$7%tF#}>@sixes_P(>^)(9trnT{Lo=|!Vs+S{FaOalamaGT z2D`g=#b7z&l#s6ZdZp>;#$kHb!KMuN8|pz`Qa2^ zAtBIaM>#{+Cm>04Q_wP#1i*%-d`posoZ%XHd zOuTxv-s|5kCs>RW+XIEsW0bN~JluV@i>cH~daSf*NQ&`?)N}|=mSV&1y-Tu0k3kCC z7jDXJgCZ;i37D;v`+^r$hCIcFs;VOl#+-tV>`KJ`<(Bbk#~xI|E&3ix={GAb{daSF zB4vvy=;oVI>gLnZ0}ZVS2DNn8q@b-e1F^Cp9IPMky8fk+NXO#$619R9gcN<}xZ}`l z5TSQnDf!D>69#Ff2^`&N^t<{zjgS{$_^v9iIG zE)M5UmtU!!>Z{#e_&8XHo=$4w&qr!4=<={AY4h**cs7iS&!DJuXN2M^&*cN2Z!mvz zml|RzVt;VPV;Zk$*B7K2K?E*D^LCoOyr|fyjYhy$5>*~@e>`){AfGvrQ8oA>Y~*^; zS{0`@Y!cVb_^0=MN3v4AWG`g2a7G)sW4te3@rylsF3G?&$X4?Hl+kT?#(iQ6P)mLz z92qq|G?3tdYj#TqYyM$qxA#uKxf=Bc+KvTfVFdU@sO0tzvyoXOo9*G&o0!f=b2xN~ zFThwO(m6&-K+qP)kU|f{BqTlA<@PC*tT)2`H^nTl_xZgt_uUa;{;_5{LZ}slO7SFw zvU+4o62l_vNX^Ee)}QneO9}pmLvZvnia9!+EaV2tV0f(;f-q#(1oFUil>|?l_o_Ip zq*zD_*-!|N6@=@Jv{kQjCd5p*#5eOIG6UQDp;@_wWH&R@WQu~i*O#Z;^OY^+weR_? zrv0T6#1;w(g6`7MC_iO2g1VNug*o_(p~8&|5!cCc&tp%0tG6$EgV;_&y@?igH$hvs z8LHAtHaRVO6y|=&Q`SutYkkewF+d^1o#)8NFYg_F&)z#l#?R#_Nes~X$Eg{ajQq8;q@CPDh+56SX(sv;bKv=|dY&DPmmICh`& z!n+H1Zt4}^CBn^@+|NHYP-lc{HHaryr#AR4Y_0<(t<{0^`4+F?R9N|Wz6+5xHJ!Mq zh@TJB7?a?Yt;T<>)vj7^F{yDdM(%mz;I+>dSWaK_FCP+8Dc)>a-b{8V8Ey6N^ue5Wl9n8MRKwLA>(Ww5tG&g34-yo=U{X!0FalhcCIpVuTMf8YO(dzwy=D;v;nn(OCcTTm_L zZ%@d`Y|+%uqYD~aSfU6(Ms)%oE&k{^$pbnN{4rTApp5i=(sqG=Y!MQ#H$ms>s1w@m zVhLHQl1y&LnQU5G#e`KEV{U5ORAvyV;{b_M$qw9JIe#;yqFgwSfY*AX*H38t!Cw$8 z`pDX2QAHM_f)&O*x}q1hNJp-dOZ4)-2C)**Tx~69cXu)i@ricslfvObU%St}RDT+t zaIdjluolwSHT0#UcWr8M7(OxeBfzbyi)+xhXk`PA1Uqanct67Vm!H7*tem|9UiNyZn{YsIHy2 z2zLeSynjlfe|s$#TLc`p&-{_J!~^}*hs9+tpo!W5)GreNic+jjT>%F#VAyml^n9=dFf7aEHCu6(TdY-e=%dp{%yt!Hi2|&@%QhS z7Y?(ps$V&NDIUP4y@dDWp^^zfCL2k4CXX$0fK4O7>vw%asBUk#?g+SHkj5UZyT?a! z`=TyBU3m^u;^67IPS3;aZSWlXYuX*nP>nuxIiCouf(vuwE9rM$Z=b6p4aW?Qt z`8*}2wE4$CNEH+m(0~6PBgvC-mjriAD|1Zh?H77TpoLSUlKnlW!2(4wJ*PkV<_-#v zgGF$9H*qh2Zm}i92SBo>Uj|_0SJ2O~9dBFS_SkvpRY?IQ4NSno$a&wRK z))MT(>Vv{xS;@C801Ix2{iw3n`F$a|&2xwIDqpZCe$LXhNip~>+$O8I~NbiMy_qPYG(7Z=2T@}TmZVV{wJ+~c48DD(ey z=vz7ewkOO*#r%8hzL$vUzcCO2Da}8QzG={Z7v^RKE+hZBM-c%aDf{P`&^x^dLhYaB z1BQTxlm72oID@+jnZKje$3`XnZ@_7}|3wwOasSN{+dlyO-=R(drhCo*nbOz)Mi0dM zDfwsGfR+AxOJc;O{$0RH0E6onh`#|6R*oou4(-nh za4Goy<+c(UCqE7c{pZXe8K-|2$Poh&u?378@Ly>3lKtPM{~HxP{oki6_;1IO5Y7K0 zDxMqr!h{60y83!OBO@?C8kiyeMuGj$Bp{#d@p1C@hhrgRGkJu~&8bnK@%BxA1r^67 zj^sc8oyXo+w<999Jffey0dRu-A*k|ozvP>mnyy%qlF+D>rQ#%S^Ifg-ru>4{v>9|> zhK+x|EWnd9)$0{iQXK+ugA)B3j%T)q)r)6Mr2JF#i+HpC>@}M{Ffeem*~$Cya!QAk zl+NJ*EtyD*YGUGgw!{#<(QH>(L^eO^1Mv&ZCH|_W7EN>`55Ii}H~J-jPa1ma>W+yN z>;lC*1trTOi4}!4Cp;_H7}9YL8#>+epKx=pHUE!0?c!wao#ZFfd^A2bKF(lwAa%A> z4LTT!KiD6NE?=xb;zDb^-2-MrTyDAE@@qQBpDpL%?b*(SHp@5-!V|VQL|gRKOG^Wi zoc`d29C2Higx7TV{?u&~xZ}@g)eZ{}FxL#@UuMNZLQH~| z2GaA#N-$JaeZ&9)MW7L4KYxFsc#|L^#{iC$wy^8`*sHr`NsN@F?!KtS-JKk5!tW33 zr)kLw#eT)b6k%aud;h%pQf9M-pjyY7$Hzv#lfvX=%(JsIp^a5fg9jfbZfjrQ%+Qy5TC(6uHT(1wPFCYM`Mi3IB4rY1I6JT8pU1R6nWYkKv1Q-43dFVg`X z#h4(R30;(_)lZq3FvwqbqEk}Bnw)uVk2kAIrhqAOa%ggPEVCK}yhjx>7@3$*7TfZh z?Yq%YSMY#a8=>}HxKAUPuNGTk-6mw66Wq|A>-48P%fQgI_eYPecfN4aJHmft?9=Oh zpiYaF+MHHTl-e|aGXLF>QC5T9z7T+vx(S|H-U!KwG)FH68d`z}(AcV{;)9IS$Q#CqhC7JI zW={s?a{E1Q2Y5xA2O+kLGlyHvZ{YB<=HdR;=fapUoTDmUqNdZW&R%Gxlm_C~6_x={c~%C!e~^s5 zUNH!jJfL%pmtmhls$~FSyJGd6q0s5_7C$vYOio2_a|WuqGSguA>Zc%Erp^yRhjjI2 zU~ew+-_SxLgzU7?BYmoUWVaYpc+LbNxj#hL3}?JswAW3)vG72_ohY}@4VE<#F-;Mw;e4yeRj%!a=WiIIZP$}fo=?Nz&Gp?^D z{nYSwY%G_=sAH%?*ZtGA0hh~-(BAIuZofR;aatwY3kg1RY=t}w6x1+smUs?fPt}7h zbi=rffODUuYJ$CJ-3^nrUqFwsEM>#EL*J-MrLOWA@T-sJm4ZBeBm9KmTIeq!llH#8 z^+kr37Cikh=T@|N`n6{EnAq4Yt~u0awYnyx>>qZMFp_E15^LKu1$4y37O%QwY&;lE*B3ie6d?V zLIg1EU0oCoe&7=d>BY^QP)XB=R3w6sxf>xqH4$-t|F`%?BDgZNxT)YK=tglWIr>f# zc$!pL_r>!i<{B3LSmx})QC=cu;kDqBm$S3%zy1Tjx_rF9%9s2o{?v~8#B(Kesp`Kq z{?&MREyagHJ5j@zPa$D$`3}kGcqsC$If$g3Xa6nu_;nIjb*ainzsqHGE`P~O!6 z85t6*@j^e7JbZO^71qj$UiMn`O`5R%LEQB&0HtbaX=y0G3!wjtgo#NZ+*S0clYTetntIhCmMIPkQs=Jz z{7ImCj_;MEULMU#g0(6my1fkMiKnWz%VFTmR17Ag4CVFPh-4>*=c3u%3VMd=3RpCj zSOJI>S3Wkv)QD%DVn6?;5-Uqwl~O;6q(C;+2P`yE_m^)-CQjC0do>sxgAqA&#nx28 z7G`nb8&xzFV8H`ZhkF=GGV4xnv_wvQwvJhmt2sT$j0kN6lD8z)vcx-h^&}%{3t27r=Nr zmD2__@YampNOsT9C~LK(G#Nhl%%L|NM{<<(hzGqa+jor0h*+7MXy=V(CAM9E<#e!K zZPXy^^ilMW48_g))6#4@@-dbZ@gR{f1-G{#dP_=ikgP&TBTcYqaQ~p7h6?tz4b&9l zl&GyjNK^7R4$=!Ec=zJA=YM1@AjQdWrDFm3{C5(h>tKqg4R$o)T;BJnv za#CuozTqcJf13gUrbTBpu0J*V7nd7{nOrpra;)7Ge;vC!z9~F6o{XvRd_B&kt}-V6 z-MKz~4G4R!JCF3iM@KPlW)pwM&cj>MGyvD0U3tw?8u_8tjs29hzKe^ZAlSw~ohBB# zL;d}c_4bT)f0OcdYz)qJ=0%LhKD~w$KKb>DcKQ8{wf^x#m~nAv%}4X20(=HSjM*i# ztei1pl05q6GFF*075`B?`Sn&g^GR=JXXdc25wjyYAErWsqiIHnCLuU6Q7WyST7kWKXU!ddN@DYJU7b)}rZOGPxM$Mc3$O`gqWEZg ltR{cP(aEpfsbkM;&uh3=LMBaUYaqa%xUh^+g@CTl{{dHF_W=L^ literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md index b94efa4c7c..77ebccf335 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md @@ -18,4 +18,111 @@ ms.topic: conceptual ms.date: 10/14/2020 --- -# Creating a new Supplemental Policy with the Wizard \ No newline at end of file +# Creating a new Supplemental Policy with the Wizard + +**Applies to** +- Windows 10 +- Windows Server 2016 and above + +Beginning in Windows 10 version 1903, WDAC supports the creation of multiple active policies on a device. One or more supplemental policies allow customers to expand a [WDAC base policy](wdac-wizard-create-base-policy.md) to increase the circle of trust of the policy. A supplemental policy can expand only one base policy, but multiple supplementals can expand the same base policy. When using supplemental policies, applications allowed by the base or its supplemental policy/policies will be allowed to execute. + +Prerequisite information about application control can be accessed through the [WDAC design guide](windows-defender-application-control-design-guide.md). This page outlines the steps to create a supplemental application control policy, configure the policy options, and the signer and file rules. + +## Expanding a Base Policy + +Once the Policy Creator > Supplemental Policy type is chosen, a policy name and file location dialog will appear to name and save the supplemental policy. The next step requires selecting a base policy to expand. To expand a base policy, the base must allow supplemental policies. The WDAC Wizard will verify whether the base poliy allows supplementals and will show either of the following confirmations. + +![Base policy allows supplemental policies](images/wdac-wizard-supplemental-expandable.png) +![Base policy does not allow supplemental policies](images/wdac-wizard-supplemental-not-expandable.png) + +If the base policy is not configured for supplemental policies, first edit the base policy to allow supplementals using the [WDAC Wizard edit workflow](edac-wizard-editing-policy.md). + +## Configuring Policy Rules + +Upon page launch, policy rules will be automatically enabled/disabled depending on the chosen template from the previous page. Choose to enable or disable the desired policy rule options by pressing the slider button next to the policy rule titles. Hovering the mouse over the policy rule title will display a short description of the rule at the bottom of the page. + +### Policy Rules Description + +A description of the policy rules, beginning with the left-most column are provided below. + +| Rule option | Description | +|------------ | ----------- | +| **Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all WDAC policies. Setting this rule option allows the F8 menu to appear to physically present users. | +| **Allow Supplemental Policies** | Use this option on a base policy to allow supplemental policies to expand it. | +| **Disable Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is only supported with the Windows 10 May 2019 Update (1903) and higher. Using it on earlier versions of Windows 10 is not supported and may have unintended results. | +|**[Hypervisor-protected code integrity](https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. This provides stronger protections against kernel malware.| +| **Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | +| **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, that has been defined as a managed installer. | +| **Require WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows 10–compatible driver must be WHQL certified. | +| **Update Policy without Rebooting** | Use this option to allow future WDAC policy updates to apply without requiring a system reboot. | +| **Unsigned System Integrity Policy** | Allows the policy to remain unsigned. When this option is removed, the policy must be signed and have UpdatePolicySigners added to the policy to enable future policy modifications. | +| **User Mode Code Integrity** | WDAC policies restrict both kernel-mode and user-mode binaries. By default, only kernel-mode binaries are restricted. Enabling this rule option validates user mode executables and scripts. | + +### Advanced Policy Rules Description + +Selecting the **+ Advanced Options** label will show another column of policy rules; advanced policy rules. A description of the policy rules are provided below. + +| Rule option | Description | +|------------ | ----------- | +| **Boot Audit on Failure** | Used when the WDAC policy is in enforcement mode. When a driver fails during startup, the WDAC policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. | +| **Disable Flight Signing** | If enabled, WDAC policies will not trust flightroot-signed binaries. This would be used in the scenario in which organizations only want to run released binaries, not flighted builds. | +| **Disable Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that’s only writable by an administrator) for any FileRule that allows a file based on FilePath. | +| **Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically-loaded libraries. | +| **Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically re-validate the reputation for files that were authorized by the ISG.| +| **Require EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All Windows 10 and later drivers will meet this requirement. | + + +![Rule options UI for Windows Allowed mode](images/wdac-wizard-rule-options-UI.png) + + +> [!NOTE] +> We recommend that you **enable Audit Mode** initially because it allows you to test new WDAC policies before you enforce them. With audit mode, no application is blocked—instead the policy logs an event whenever an application outside the policy is started. For this reason, all templates have Audit Mode enabled by default. + +## Creating custom file rules + +File rules in an application control policy will specify the level at which appiations will be identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** will open the custom file rule conditions panel to create and customize targeted file rules for your policy. The Wizard supports 4 types of file rules: + +### Publisher Rules + +The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specifity of the rule. The table below shows the relationship between the slider placement, the corresponding WDAC rule level and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. + +| Rule Condition | WDAC Rule Level | Description | +|------------ | ----------- | ----------- | +| **Issuing CA** | PCACertificate | Highest available certificate is added to the signers. This is typically the PCA certificate, one level below the root certificate. Any file signed by this certificate will be affected. | +| **Publisher** | Publisher | This rule is a combination of the PCACertificate rule and the common name (CN) of the leaf certificate. Any file signed by a major CA but with a leaf from a specific company, for example a device driver corp, is affected. | +| **File version** | SignedVersion | This rule is a combination of PCACertificate, Publisher and a version number. Anything from the specified publisher with a version at or above the one specified is affected. | +| **File name** | FilePublisher | Most specific. Combination of the file name, publisher and PCA certificate as well as a minimum version number. Files from the publisher with the specified name and greater or equal to the specified version are affected. | + + +![Custom filepublisher file rule creation](images/wdac-wizard-custom-publisher-rule.png) + +### Filepath Rules + +Filepath rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. To create a filepath rule, simply select the file using the *Browse* button. + +### File Attribute Rules + +The Wizard supports the creation of [file name rules](select-types-of-rules-to-create#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (eg. DLLs) may all share the same product name, for instance. This allows users to easily create targeted policies based on the Product Name filename rule level. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. + +| Rule level | Description | +|------------ | ----------- | +| **Original Filename** | Specifies the original file name, or the name with which the file was first created, of the binary. | +| **File description** | Specifies the file description provided by the developer of the binary. | +| **Product name** | Specifies the name of the product with which the binary ships. | +| **Internal name** | Specifies the internal name of the binary. | + + +![Custom file attributes rule](images/wdac-wizard-custom-file-attribute-rule.png) + +### File Hash Rules + +Lastly, the Wizard supports creating file rules using the hash of the file. Although this level is specific, it can cause additional administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. By default, the Wizard will use file hash as the fallback in case a file rule cannot be created using the specified file rule level. + + +#### Deleting Signing Rules + +The policy signing rules list table on the left of the page will document the allow and deny rules in the template, as well as any custom rules you create. Template signing rules and custom rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. you will be prompted for additional confirmation. Select `Yes` to remove the rule from the policy and the rules table. + +## Up next + +- [Editing a WDAC policy using the Wizard](wdac-wizard-editing-policy.md) \ No newline at end of file From ad081c331b090d9a1c16c49ae8b6824a124cac81 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 2 Nov 2020 14:47:40 -0800 Subject: [PATCH 007/206] Added the edit policy content - how to edit policy rules, add file rules and remove file rules. --- .../images/wdac-wizard-edit-policy-rules.png | Bin 0 -> 57280 bytes .../wdac-wizard-edit-remove-file-rule.png | Bin 0 -> 46086 bytes .../wdac-wizard-editing-policy.md | 54 +++++++++++++++++- 3 files changed, 53 insertions(+), 1 deletion(-) create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-edit-policy-rules.png create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-edit-remove-file-rule.png diff --git a/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-edit-policy-rules.png b/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-edit-policy-rules.png new file mode 100644 index 0000000000000000000000000000000000000000..fbbad28cf2cefe4e97f2058a019238189e0816ff GIT binary patch literal 57280 zcmb5VV{~Or@GpFlOsq*Vu`{u4+n(6AZA~z-ZQHh!iS3-&wsSMj|K9iGyYBsP*4bUX zc2)PTy{mqO4wIJ^gNMO_0RRB-65_&&005{t0080$1^PufX@cJW`U7!P6cYqgP2wDX z4ZfKQ$Or%cwb8I|`ruzE91z(*)lQ0091y5Ef8&(>coo*Fu#-?=iJS zPo^zALu-Fs2@_xWU9j;?ofYX%)I>z7PqiHRr!q7kFVu;x*|2-19TwDJ>oJSt6aOre zgNdu1%hY5tL&jf6_ZSJIXt znfb`BFu~V&=hWXNUKAYZe`avA>oXs-Q56Y8&rngnIDE}d9XK{Qjuzc@iq(frzg`dk zA<2=M4gT>V_%P!&=VH3`qj+8JhfEF&-JzlNhD%9G`|;mw7u7CrfaKFB6ckjBAc+@s zX@cD9WH`F53fls*nfV5sZ-Oq5`O*fqGAJM}yq=Rb+Ry*VTgak4Bf$UY+#4MT;dwAQ zK4(-ia=zdHFsQg)4c6VArPJM9oGzt#S|oOPs5pz9W$S3oVb_}Q$2;!f-BT%7PSHLiKM{SW5Wl>DMw5I5iJe+jGoCC(^OYiKmzDtNS2J4J{O#K*impREne$e z<-a27b8=62p@&EU{MJlKUETq3R^7cQXm~;X?}wOkTp-~(8_pmt9=mnTuivxjCt5Px zEki4ndQiej5o%vbWwL~xz4oVNgT&Ez+@^CX4|n}{275~VRXR`lk>xzv;jwmdzY*-tgr%#>AvRqT zz?XgQ5E>p_liaojyds{WW{Cc$`TKbY zTuUNRt2fy<8(7Ini>MbBQiaf}D!l9b-iG{%$@8_zsm0X~P^}H#Lcy#yFpr+U-~KMK z210s1>#m`=!J=7ILt}b}}?Oa)fWtlz&31)RbH0jZVYM`rH0+GTz7^ zs=PSyV5d{W5VEr^zdbRUU?I@g=| zEn?|=E+@0+w)+{P2j~7U%)2e`TlYO7VxBF2OPFuP`xbBwjqe@rcz6+Ogkal9#9NC7I#v3rH{_*XG%yWjLfzEGo&L$CGVF#UOS7( z-pX{bYyWz*-_#ch)tmc|8uUWodBizBLxm_|5=tAS8%vftD1HX5(%?P8VCcHvq_Md? zK1Qy=1{4!dTMlwG9G&0Be&*_#kdXpJ`_EVX^1}5c_Wsc1plCD$=?%~&U?y=n@63kA zF{2T1+bW20>@N3}a@}k$S))PBF4;RkAk5B-(s(_@P1w*z292PQo9V2VwVuW<7&ATZ zE<7o(H>1j>&M6PJ zEsg^!;%A|;_0`Dd@6+byPaQs>3w;pLVquvX&Q=bE&Z zOiC7*gU`2K2o6(f=n8+7?u8e3erYDpB7@WU4`+4RKiid!abzzTF7A=7D{3H_l zx|4zynQEH78fDRLe>@UXnTsGQ`m{?v6P`juiNYLdqa?-=na0?Wmh(BFF8gzs?g;uf zGPJ(dpPMkpyq!GI@jA_<7p}yE)3zKgU*6nqJiKqK_L>X5jp~vfDRs$KO?xt2Rj8 zSFwin(s?}JJpy0#Qa}RAjr=A;{0|B75aEIyBR=brM!j9mHk<5X3D@NrYDtE(8ZGa% z5AnD73iKm)cJd6!`wB&f7X0wyXpp9xOupeEKx%kb?C<@7b@s0#`0Q6=gCwKlNyKk9 z-z{nhV44%XoMD?@tGTC7m_l^hKwj)0?V$$LAxfjHti(SrK}6cl*l{8ucY9fKgYwZs zLWnG}S-{uFqwmLSCR5JylZ=fMS;dvaEH4ss`HU)<_T|$ed$+WNEuFX=+3~Y^>+!|B z+v7>tgV5tp0_Chop1rw`S}M%Sc$=Sz3}oQ5<^ADkH8CPQ-K{9#o}@SJ-n>f0AUnBh z1xb=aw`5Nqr8}f4!09E==)e5sTdA75`rzPTFF-4)^WoY3sHy)foz+};5Kv+=Fgc=t zhB^ux{wIsHq4l;d39Wp2T2ilI>|{kz+&G}d^4R{)imMU4XZlYR{LupZiy9n6y+S`J z97Mi;{)-dDMuWtyy7yg(bP90ASq6-$-^K-{5dCmUv;Hs}_7Dy;M;13rzrQ!KToW1| z9-`U&`eRn7`S+<8oerxXcyC^Vlbp2>Lr^y$HBC*WYq_hpK`H7j@vD+;goG^=?(x1x3^nha%|u|* zvUfk|DV}Z_Ls87;`TfN zx1-#@7lz<_H|?~GichsXICZ1>h#k>C{3dYos|n@b9F#D{h|7N@1r{@AxKz3SP*)kC z$#5x4UkFmlXKr}U9%pH01_@@2TRZUI9Rr^r_SN5mXO5hPE@3idi)UgCBfsdOz9>ej z|6#)ttpAT?%=v%#FwcTu?duVINn7CmAGx7r{#IoFt?n1titPUu8vK7qp#O&iSC{!8 zrc{PE;`$F={$KJwU+0SSrzpF`x#HIuaNN#pZj4*<9zVijPlRdw!3-7 zK!rY>y6d+lHQ>r!2qTNDi`!Qk(SsL?k-Gve;34Vw!h~caS;x?+D2}@))VrU#Cc9>l z%}|Rn*!pYcY$@Eq?;`vWq9sJSK+M=NkExQYr9-+gNM6zPEJ2b8QLFeb%;EYSN}>MQ z2g$c>pTnPUmYwe$7n?zU#De&&fvp^<&&XPEV?*}5sIS#2bAjj!*EhctarK}2;-cPV z=X-VW2;%=T=CPWzu`IP`)1rQ&#W9R?Lk~}s9Ci1GYpad*x15op(hM`fod)kdE5m)g zIzC8WJG%WSGv+V1E!_@^3BEnfRi7pafGX28HQx(_s{uJxIkgOO=8ooJxB2}9@C`~Kr%GVQ)882Nbj{hJmEJZ~Z!_GR&8K?1pjtL?dDa&ATbOL9B z6QjsEa$U!LPZ0^T#8v^Dn5@5N*b^$Z7Mx(H*vL^`DD5=HU4w?##x!*0Spl#7?#2u5 zls|Y(N%%cE=6)usm9?MKotAz+^dQUEeaSU|G*nxPOfdvQUuJzHf;mpZmxf4~L<_i= zgM`vj@#U&$;8dJJC@8)WTuLSSed&%5(YN8;>tUzSxSLnGARz=>BVsc}IwO1#QThj# z`F#lE?g;@mHBU%P*rp9WW*RIl>b3@ezZ+$Ej=u<_CPJ?X8g0mYgB6L9JC_%Lg9ez+ zO3Y|5a&Y#m#e>68S!(xu=#4cZiK62Fiv+f|LXqZt^2Ftb1seLdv4F4BGmbhUHxF^)UJbaeaid4%hw_G~*kGVibmVgQ2L2 zhwI~DfneC%^2p z-yPheks#jZFrHKU^7{U_nS-_(u1+i|3pyr~Y(}SBII#E?iG$>L4&%*)1WU z`?`5x_|Ct%LNyTfyc{E3V-f_NdWXroS^Ev3oVR1|$%Zn?SkH&=SNX}_yA{Lh3(|@M zVWdd!v~FZz40tnf>cH}VtD#t1X|0Z|B0uS21x89eVgtUv!yHTo zpYp9u>xb@bB_g#zroLxw!lQ=x0AjXUq zEc)ZL?>%}HBqPMgj908okwtM5sPxU8WSOj%7f#lczw_An9AlQ0W=YmM&EOJ@d<_sO zLU~5P_`99tm}{0E&^>HDKPGLnO5a)WNZxSpFH^n;17gt7EoTd1T5OHPNtdh=_(=;N zbb3$@&`r$tglFG;Fi6cj4puiF2Q5$=E~jUA*;7$&2LDH2fB05inzUQserR8X=jFw? zUZRA!oZ5W|VxU4k=F~4B0S3`8^M3W>$mGs=NDhJ|SJom3(hztENvcsgW1@&%tA;}y zXAG4uRsf}I?E7c;Iq`Y0KqtshXX$f<%BRkAVXzuqFh)4yB%u}acD5WYlJ3zDA~0(A z=6m0>3f^wLIt<%ttQ-Wd%-sZW8Na)1dzB-ALHQ<3f^NO9!q%`}p^zcGy3v_`^Fv;h zLvYecoyHUL@D?HY=U%4z@qH$nep$t|iz!u13}A+%(^{!#YL^dP;psH1MK7tlWVaZs zP{Uc;HlOp3tE#~jNdC16-RFl0@ySUN(iHro%t%1vci`|FtU;qurRu3Y)%ZMI#19_6 zaMVsaX1!1UqG2X5=ph{tc_mP25SC)M2DM7pIm=_fVY2Bk(>FLr%G&?5I$))^caf`zP%z*=?b#J&SZ0V~N}J76RI9GE13@CcR*3HAo_)G}8}AB%A|`}8L*^n) znd|LlMCJ5E{<$jVgYR#UzvAUF^fQbT_^b3Q-II>%@}U?uQW$&`~vCE`>M#;@; z96{FY)J%B6hL-lEJW-)?4b*sXmjh2I$0(*f`85ZzxnHaQ+O8XErL|RXu6C4N=R?bK za2#tn@nSoN6HaeAX+545Pr&Uj?p)ryV0~^W`~K4dZeM+N_ZM;szRtLI94W6MMsb0xj57l zH+zARv}+ocX1V=shIi+|)fX5fK+OrC67&}ixK{Gtq`I?pc%3ah=(L9Frgi31@fO63 zQZl9Yg~8KP(}a$4{Bl@RB_0^wADW-njV0{=JYrPNBh35Q-a1E~`wmKfnH&e^&*xM) zvSov{^hL)BUsHC%R!oBOoHMYze=w$()=!m=bPG@3 z)>l=9JCtDjLpwe^A7*PSzh$~c0DZ0Zac|_}9386XH|+^_wgOx!yHu6h)^*(QT=+>H zQJrw9(Lyfg8ow^~FaBYmr@}9@R4flw#__bp&YMDV`m$t4E&SMW%Ly!f%1M^GEJ; zhmVBFF^erfEp%;3;)jJ9t+xI+-vJGWC8Mc$!mKrBOV*=|`p*X>@O@-d9^~s`S^%WS z2M-TaFB#j!r%s;3j4@OY{~k||)V8#$Hq&XbV?yR21+u`Hp7Bh-`vk(;}xFJd))9D6HR*68wum8qRL*E?4H8r?U#0?@BW5zqpV)MQS8I61i*kHKZP76XNK#0iKnMm9 zzle1Mb$eQA8a=i@oZWVvk%Z&Z1+U2DE8V7GT5VO2getUzV16lwauFfVm8UXmY_+3r zHD~8kTq2iF^Vai7MF;3(f0LSGTA-l~a&@CM5&MH8A+)4G1s;W1NC^MscFDlK#rD^r z(-thAhEyFoQaU1`{;9|p^oWb{6aCn2*Z8A2X8S7+2<7`i@!grn*of4)fmJeJQO5v2 zG-K-H=6Oz3=@NL3*|b87k4zw2Xjf>1AeR2@9r#HwbM1$JN1wFm$%Qy zTRwKhFYCc{^@~+TSNC(H-F4b)Xm}Xd;f_Mf0GH0;cyP8-|67nSF)V0kD_kd}0yu?k zW>xIh?dv^aiG;r@%NY;P1pCB2q1p{q|JR7|n;>EIV2_!TKR`nhEfz4A!<36-QW&rP ziQP2On7PLa*Uw%RKlBpR>4VY27Wl-jhN?h<$AyFJagB=lZc%m4A>Fa~02%MT_rydA zr9ff@#FzcujpwoW(8*SEmF(v9CeHhoTWrN=7m}b1lUPaF^FrPJmn}gax<-(FzV>3;+5^cIk2DMl!Ro+&?_ntkfBot5h;FG7d#zLnhP1DY~qvuV?2*{GHDzMy%G zAibMK0N!mib+?$u+B!;j@B7TzS|9`*Cpsh`ePSE>4(<-%W@~H7Wi#V*0LbL{cIE5?q3oJ*L(}hq&OimNsZyHf^)TOSz_ExJJ8YNUWv#HUw#x(_@ zUrrXU)5~jkXtx?96qnhqC-+L45pi#3be9a#wh2?z>+I}0OwNQ#wTl|72!bbWPkWiy zpZTJ3<{pSjQNF0fo{8T+Qhg-|oOnfc;GW6~cyP`zeJ4JnSnpKpcYw(~F zqyzSa++^>2dokB49lH}7q16~5eUu(Jr-UDsNjHyVyy-w}VMQ82TOr>U(w9ip;Tl6& zLeK)I#%L6J$cholUdJbqpNW`76lmz*O|v0aC-_E7<~P39PS+DB@X-Hr30W_e0e^uN zYJ=1Gs0Qf~Sa!;|!-qqm&S4u$s$!nV%jIlP41`I~RsQ+)Y4g!>xn7PZGyUzvzg6~7#~=%0yOc^MuFM>abGcfCW8+>fX30@ zob%URb4*5tma?+2&rvyJoTVzZbZ`@#b;mYC6nd7`i5mgDZ{pGecmZ)w={B2&x{o1A%6AK)5ioeAeMnhz$=Cs zr0?Q`8ERFJy@;EuCor(8UJg&IMx;J5>cVvKu>=j;(Wql=x&jaz%Xb57Eed{tKjU;U z%8YTkWRIiO)@c2v5)Y-mRD7^n%#PQUbDS{-nUUs2xz?A|mUaUiv-bj|uI3sud~{`J zR+DD#5vmSDd^Bv`#*2eQ$yu%vgGX1actFFE4Rm|ATEnO_Rc6W!*_<;m5a17AF5)-% zkHevyU?wk)Yhs0zFf4JhWSP$r@HX+}hXPHtv<-x+oGnOpp0;FBADf6ZNBy15)PuV9 z9l~ad*m_k2SPIXYF;KomH}5S^onvpmY1G508-|b}P^b!~_AMb=x$ETTG$FL>SReDe zVnyj@ueqL5bra%BoHv|YBc{fee7E4U{N7lsuMrPX^JgO6DR4W?yPe$LYfJ1E|J)L2 z2!8F}s+t^ShK(2q;#M%qzPTqWxI_Q^`4buWep=mK^6g*sEQgzj2=u_8qcrI6)^+d6v(z~o?{clr zuMwd{5sxirio2nn)Fry5idEi4Eb7g7tK!F(1tA&(WZ0&u3=Q9!5Ps4F%?3t5bTpr# zQg--9bSxEITO)wKJdFdp+i7>El17O%f{%5vXm2b-@?Q7dvtM@!1b6d5MCEi3x*zXc zCJPmWG`wG;Q{8*nab4D z>S5m!(Z-@_XL`--B`RkVW6|n{<);HGV22LZY@=(!XsNPol{rFx+sqKOr;|(}HtT}6 z3=P*m+p&4&d9f3d>CuHgdpn8S*O^W3O(BfiNlz4PsQey+Fv^ITu*7I@-nM?Rx& zf&AZ+00I~hvdBLh5KbcyJ)NfQ+wnZrBtOCg=8Pw7^f8k9Dx7Z@!Rk!3a4d1zlh`~H zSOFClZW1VQT5QMS3*)y$zp_DuBNr_72r2FJ3lza?cPZ^dY&N!RJ4G9R%(BVps&JE2 zY99MDUzSkH-%ZbVi$vme=BAag)D4MTxk*L6(*zcyJ{~E*#$m;eCGJa-D?OcUCAPD` zXy9`n->HwbTmYP~12;PUBA>*pB3+eOLe>bDyj!WE6v?B;kq6kk{K(%iig{Ds%tp}R z_R_IO=_RD#N^1D+@6mbEcru*|#a#AF>$|xmYkCtzwBP;T1JrV-ad|0lo5gyP8K}tK z%V+JM1J(W-$X7?YEl2j33X*kcFrPmBYtIt5rSjxyY_fLWmvSqL1q1}#B@lBVMjx~h?fa^|QYzF2!Ho_MB9k=4-nG|INt;|9N9bXpV@($Z4K{kp`ePiFsxf$al%^^)3= ze)gi#jqg+;VfRbG2kC9!F9MDs6mdN>V2&6(uc;E8g;}%Knz%!?A~R~2H7tuva`MeO zg^`SSr?-g(;h1C4AxvC4CEF#q&OosnwAFV*dm<@w^5(wENkI6*q7DTDk=0FNKoPZh>d(2cnaA?wLsrHj4ebpn^n{CY zg{S5@HQgoweFn0)76Nkuu^f(sH?~u?4u#KTg+Y8_z{oid0=gC zHDq;b_x-O?=6FH0w~Fr{K|q-WE#z00r@njHRxR52QDWr3J@e(NboBH!=_ZT_{thWH zw=pw_{I{h^sAy<^=ckWB898b$=M1i&R=l)-stjG!m+JBJ5QG>8L6~`u`e{@K8^a&Z zQoeN>lmjQfFlFoANf?7sq0WS_-{f2OaD1)}3J-NySkS(3NRcy7--l!d&%DVIm5Dba zD!n`1lr0XM$=-q5j=^$#dN~9l*4xy*8{nIe*z%njkhJZnp|kQlPl`^z%yI1mfytYt z+&o9qL;4FgNUH5UZwK}@;wB^5ZaCRR&)^lenKvO%n9Kis&8@7YaeQ%JLmqZ?o!@8` zvR1`G^^CLxT099$O?XQyBqz1r0R+lXL_E4XAkmWxJV*9_>==+)^=h)N5E1R;2;pp{lNH60Hq@tO@Pr7ofAWV+H%SRi$xK|B4?D!gDgwAFWlb-e`Wj z4=t}}W@&OVq9Xg0`e(t|jTFNIINxw>eAb5!N>(;Rti`@-f6`LgA%sFpsoqMx zd<5Q3-EgryxK_BD_^ge6Al?9cuGNPsIu(i)=iM1bCn0rZIgq1I9q&M(pd+!6GQO#X zQ8yDl54{O9J`LU&;{_ZQr@L>J< zNh}9Qr@NIubN-&j3ENfSX{K)EU7K_B>}hhgm{s1~ADE9vYHQ#g66)LT)1u*L6^tN( zkAo~YkV_+!PRsk8B#N*7YWdb5XV{SoPrS?XA@|V}hfeYoJ4Mzw(b$D6#lsG`5qWK) zm9XifD|rxz4kmc3_xE;yNX*tiFT3f5HNrK;3p-f#b-lBgcrnoGs?)v84<-bs)t8YM zXm+54alv>V42QmUChNC7!Ig)g9j%2Hxyw-N@|EvCYZbC7IqjXN;bjZ+M7R-26$atM zyYVZGJ31Q(vsB`al~XS(T8DawDYG9jyi5BUc}mGn=WZWUcNu z(DjCn5ap|G)0K@wn$j)&;by#7*I(a3uN?^~@LI_%=3^g~e*l1|?&!8dJhY0J?nGRl z8V6qi2Y@u8Y!$J>_d@dTM@|rn?9iodv9s=@-Nm)CHLGZTeVdxT-xzD*?(ok+Y{;V? z!L*ceysvm6r~|?|!aS8Dhs54RbVNTPi{(e1*&vDP!=}mTgcD{a7V_g^wE16O8pTrk zopst|q3(N??RkLT%h2BzEv$GMn@~C>Xc2`?fRaJ8To7uTme7^%FLw1Rr=LAZYN8Cf%RUxfaDCB|+@tzP{@(hyNKg_(+ky&`y5#0ux_?51>~O{XS< zZ`}|Cnh6EUAOvR7#a0PWl^|CLKApBUr_S#Yj3Sb)f+YT77S8_48}+oF`|wCOzWxb0nXZu6x z4aEe3Q5b5T8z1DxG8>|8eS|W}3SRb}1sdapK~@!m&zG_o;Lcnf#a`;ONd^`PT9 zH2`vQ9x9GDCmO{NZI*SQF8F+!S&;FUMB7ab19=D)*!(65A#Y!!70a3{5ZHeFC_Va% zKGB)D(U7{Ik+csSx(#GU#`r2a-!6gwSKEC$mfvew({Z!a7!~sC#+r8VS-6)S@Ez`c zf>Ivnzhi7p_2ny&e7mae>lx|uD+a%GK%E?(v#j5h~ zehhtk0jj^B=rU>nCEbJ#PLdO@_S8?7I*zz^6huersdqR^%arP%CAQ`$(dmiE8#BR+ zQz?pDDTYJkfZQYGniWLV`ai$&QMRM_)?BSxMSkiIj5-h7+XXzuc|(`Jty~&#es5=| z8K|DXO|STK-Gf+CP%Rf?BI6H#^fCNBvJPp7_1iQrG|G~_?E&PDLQFD=2)2`jEtNX`G&&_x5COz*FP|s8>&e^OCV@2O0|; ztg1PCQ=&$Q@9p5Gm6%Iv4*N3-{_a=u0!p6^&1^)vixv(88Wz4ncRLbqGHw3FEWpKA zTy=+I3F)L#fu5%!NYN7)MDaP3^7(}_{Ie1pN9NOsd(*;lF&+t0ozYx0TUhj!#(7P) zuHGQh`Cn_AuA5yKN%T%7+-d3>Dv5_KO2alq)T&ahdiXW!fXu2 z9ZlJqgrsuAY~__2QkXy~O6CYS!AeJ!s2-${QZ=>5pf17T%$yo9l58v($CQV=hybsZ zZ0vI=pT6XSc1@YpHSL7CGj^DrO(DY(?2cRtlgy7&GQ{rg z{^Bg7KMC!OIW_1OJv6|u$ZB$^*GF>TzFcw|b|=S~5Qs?1mt{brT3S8$%k2>DUw%~O zZKg>nSAGsN&9TWz`)BGOH}+#XSRVBQk)&(9_BNVj##AgiqAYsQ!f58O#6rZ3o!^Q? z5|m5aK?RD3QVScFOk=zm#43V9#X^be{aR`_saKVRg@{t636$z(-+u5)_f}rrUwQBk2*dzJB%rjyLuUU;ue(-(5KzvO%A$wFZ zZ{!ODDBi7;@Xjb1W~y}W0|TkyLkDMU;2JAyCEbLU4^OAmS{e<_lNUt31Pel@Y<&ss z4+B35Q+3sRD}s1|AgOqI{>z!(lZnO>8O(rq)*%?2`Vxr!6i2yEhF6{J5%ByI1v%1t zTU++sp3^0mCLtbNOIZEo^C$jP9XovQz%68+WD6w9SCgZtd%6=@$S z!ySH|4)JSu4Y%Z?_U4c({nTGSEaWFr*b1!Se>t60=G@d_oQ#Za{)P<2C5wY`3}-Rm&6JEpoG{j-smBJ<(NN6(YG(Y_s*cbN;< zmO5gO1ZUR*@k47G$hv;dDb;k4|0)25IM9NZqF)zZJ%yC~Yhf3tg8yCrUo`_k{QndN z%t*4gC?PXPku0|8j}uD1q3Mc+Oa)-_%D!OGW>W|INffh+7+&88;naP@3Y;)b?kL9j zx1La4f5|slvxT~!LfV;R5m>z3)Uvq~&w6V)+a0%Z(K@I2=seJOh;nZoUxffBv-;tu zS`>nQ-1Cbfy=gDOehNfgb=xxr1tU9t;UeyfzN{M65wCx(Q#HgmJaHk+B`TlZl1~^tBH?}j_EP1WE40(+Cbr^;UXe_ zYiNvorOo~oU)8aR@CSKt$&Ggc84J|ArZF6)(6byLX{Z#5eP{q~;fUV|IYxYVic(aQ$5-@z< z?+9+Ck6N4Ayl~IZMt{sip0M88T`uJeTc9Y>pg?%<%#W_gbqXK+*H6ZWo!y}tI*1BN zkh$XsoH%Ja+@+P1d+qjZagK>Bmly9)#Z8kF5_%uiUaROzs&k#Hioh;bm9c5LRuh~o zMJ>u|2UmQPt_pg)^MGY@-LPJ-g%EUQKyUWCL zu-eG8*+|ljyybK2N7HQnEEH__InD8gf(~9`{u6)QzpRQV4F zOva4=YPZm(>n?v_9XTVk@tk(d#Ll^W(39Vkn3z`9ReiAUtWAKx+&& zS{ySN!xXBGKBlo66~vDjn>360;HkHYaGJoMq{Fbkpt;zDmk)xEzYnt^vEi;aCQ{RO zr1dLW;uZ?ZV9B-lrFXbmPM6jf2O_*$x@Ohpky#GR7cRQYVJ*_zDhoxMs^uGB#;($- z(5QKOE^ae%KB`P;c3xgGMX$l!kVuM_AIPBo{am^nu+QkkC@ulQ!7MVC-h;sfeqh{n=?d-N10=! zJmO@aL1Bf66&~8IQ6I-&nfrHc#pQg{_Hm}U`dAtPg}eafZ;pXe5n48^@*lz2AZbMa zX{!IketoJ_qvGhn{&5ZG-VXG$`3i{**>#HKu^~0G0@CEx)v|P}bTCMw)&zmn^qvAL z`X4oJkZ^(cuyA9^jN$!Il7ZIsPn5g!Qy@gD#{1G-5Z5vI*6q&%tm;a#mihHM2y~eg zANLEMXy`6Cl&D;GSuNtSdCszJXi0V;Zb%z*{@M>WQzE$Q@HaSY4{>|1-` zduj*L7zcV5aFiC*3PO*G>Nzl89t-{j-%r9d!2W#96Fuk7b(jA{WD=Sl|c+NQp^vHbrn3*^E=a&802Q)Z04IVltNqF-`wA%-r z@{R96_W}g3$Vq2Tj%TUz9{RV{F^+T>V5Ap?Dml1TlzdOfA_`?^z)&taBz&=CVVB+E zwgC|A@8|3K9^38ct5tavCmC0B#r7LXD3AxPAFfm!8nSaSv}CIrKwatd!?(knz+}aG zRas7`YO=ItY67uNRb>F>9yzbdO=E zRt-NjLZ5LCfA1|2?2CM|89`X_Gf-A-I9j1>yk$J6=-_c}A;U@^pe@&<&&d-y6{ni3 z`(DiAXAE3(IO9N7=&;qq?H^y`nJD^(e_Q*&vZW*S;m`L;ef_e}sqxD_I}Ow88X{0& z4h5z-5@%VckXfU1iocp`f^;{3wwnV}a`T!j< zGYJ!RS)FEi5f#rcf8-Pni}J`J#V`47R2BqN1#X1bUtT-C^{V7Eu7|n}ncc)$oAyjN z_svOgmbscd!<=-K^cA<<+(#Y(pprkJlOMFiuXHci4F;fw6aD3pJt?+~)IvKeWv)7L zCL~)Q9v);75Ds^8102t-tj~(A7Dh^E>l({^**(P#qtu;^!lP|fTGr;>#c~OpP7`uj z`!Dv)6&LIunuN}iA$zuZx9TO>I>fkWC>IO(o7c-4J&pF>ak*RuhPp5HWm96bA?1Qz zWN{6eL4y&^Z=$hxjSuRK8-;|(DU|BmHV)?e%QJ&Hs{)WlB*i?7w-Gi87KMVipYv61dpSivint=b2cw)S? zKfh~AD_|Xk+sR0^%W0)Wg5CFollQ%4eqO}I+)%31_iW~N`2AIy#+;^`ySVDN&}X1P zF^wbsLajQA64-m132BuJ*sH4*P5dYyp7eIgSk9b?!SM<zoGVT^`Iulp zCYr>WKU>an>ni#&rHBhLvrJ7e^@a~iA8Ou@!D0caTiX*ttiwoObIy-S+Rh ztLe&c4n>}>d% zA{0#3>1)Yg)&WM{Za?eH7w)ZlJ+CY*(`7_GPtP+b)M2G81HW1qZ)I4py=pzBhbJ&m zJmxpOj)=38Jxtx(jp14bRa7t@kcTH2sL_XS5!+e27Jj<-jZOAy_pv?9S3q8Qo;IkK zz)aB)h3K=7J!Q=wZ4^7kBQrkGF@2&DDj69|amQB5$S`A>ET-X~Yhbd}=$m#B!rfEJg-- z4_CJMQ9F;U9~nuA?dY5B&?N83s1{q<%FP6>U#FjzOIYXf_+z17Db>MvY~jMxmQX~) zh?Cs?xg}ux|Jc194-wjo&IMv$q>yUJ&Zj3n_&>qhmB(H5JYmnRCajbz^Fg5e%6;F_`4lq;66KmShppZZ(ahHF)_N3~1_EbQ& zva0NWmviB?Mq2+tXO7nmVwhZ!EN&dw-iXbTQ!FSjZb0aSMN?hkHpA*$s|?d$P(w|b zm^P|+rp+7wNA4RTvD-z=M@#EpJJ{};EuD1uO8 z1@0c69XDhXy{tASbUMVITzN}}ctg;G!eKGl3^BkJySK=#_%NNEtiXHf#1;NxV=BS| zy;B_!c`tgkT0PP9vasma?^;9be9)eU`O07%*Vt`WSnMM9)l7~Qruu)-6C@{PE*YqS zYg2%fOALF^PdhtJ7Ao1L@gEGUX?a^;Py)q_MzOUuUU)ny_FOBW{c=3sT@|8vOeZsx zC*~JcQWruQGrqT$h>Hscp>N%51%Nyomig`OA zQRVk0_A4&D-$w*}0~(=)ZqF#iM(Z=FNt={z6U&#MUb9sB{F+=*DFNx(o8GBfs!}ps zjleV@+2*D{${fKG_x?naf+CAAfHAg+>yF*kNy&AO)>-vxist)eYd-jUjkSUivmT$+ zJYB7H0pEszTmW41FLgP($?m3nVgW1FMW6{w#3+c!AqqRGk)bD!3#g%8k$amNvM`Rk=Ct zP}Us98Fek%aKd=Wv80@~dI8%fUX1AkU%>9oC{j^uD|wO8Sxi{?tK6->kLd_QpPdaI z6H)E6h8F7rQYwzmN|!|SQdc|Soe?5wVnY&oF4;&1AF7A}!=0lUMo}dRIZFodf#^%( zOD3^oW0@Lt5fL!?tAV?U_f8n2b8^sI!x*swLiZZ45BN4H)@^iFC*5^%LrG;!W!^|*H8D1GxFudi<+VV;(K zbJdOz+KQ|J%)l)^7MRlIv0QquPC$=M8xZ~-7N)2bTHC;^09vupl2Gms7OmfM2RXdf$6Qf?Y26}6O}ps_sNKz zp$-y{r_Q88z^7I^au=u7=s8M;>#d20x^GxxHhfSS8V*8;77e`&+K`lD@~uJUb*ZO? z`f9Wb3=)-Ht#oXG0e*}CSk_ze$CyqROk}JTPF?8hM3|dF%6R{7NlQSPbw z3Vg~p%Enc3-Q+)BRKL#CW9oj6u0r}1CMn?-&nCIZFRA|4#Q8AkfP4}XY4#gK(CC{Hf zlk-yNaFZJ0fSBDOBT;>a0|p&FIsG9Jt>ER5?c=-iusL&mrP*zs3{0|oe3-&zJm%j^ z{aBqSrb%^Wj%}G=F&jF8*V*jCYZM5_tkm&rcb7fCs8gvL7<^WLM$YRzAU>2Vcjb9l zO2z72A40TfIY`X+Ew4FfLdhJC!s47dG@2iso#mac(?B}g=UkYpw4qt!s-C2S?xbI6 z>uT4`7P=AX_q=~JcgU@b_dHL_x7FGhKI)==Pw9;BM=omz^al)cRaneBy1G_t_Md1V z>q|E%5*10OR~a%KOhz_V;Em~j)S|E&GyE7G#Vo(v{3*p7;R!#l@CQ|$zFR{jgRBs! zy|Pl49B!#gw*;!7$gp0wE*|!OQFhirarF(BMgk;g(BK3J z65QQ_TX1)GcX!v|?$WrsLnFc6-QC@{Uz_>n+ufPnf4i!yy6>&J)%`r@oS(s?-cj$~ z`H$m%$L!O#s|`~PJBk@Nns^&Royz2_eeKzd*rYdV?CTx}UlgIGcNSJi;(zh?flBC@5B4Rd`!HWia zzCmxoRJ`EmBCwRLOM*EwKGBty0b97pW7oHWB6`60Snl$CILovBdS1BLa;@ZRXbbZV zYaw6p6gz>KF15fnn8%_tEhI=*Z?yue7ZpV=J&<-J%il{o+`7Z`UYkUuJs=RM{FI0l zvS%w@mf`6CN#F_d$V^_Ym-b^iWJZ(Q^GIaKORgSABx3910CwCwHq>#l*xgIi+U1TM6*FQ&11LHoNdQ?*EUj#M{mOU;T*(=>Mh$dRgBP2Sok& z>0wt{=K$wGraM}vs#)?Wc$rXFLEi6|<{h&i4`i#AwOlR-igW8a9Grz1Fq`t|GQGJ?^j_+VaImiqZNf^dX~6pi zT~CB8l@d&>2R>zn42k@WE!nkM6fAttQVvIvMDe8Xc`wKFF-%inGi5}S)r$a>y*qHAdE8GR2>qhLI@UQlIx=YkbuJx07+O&O#pDucm!(MKY!8=ewO(5w3-YB1V9be6 z^J?Ad?H#OER#OJQMUaFKa?_{9Vy2~Le(Rw@Xu0EZX5GD*noN^!+o=g{L}pmvO30U~ zK%>f9y4x8YsS5O5W^ZOLoBt}+@3$8>xW~=eK++;AqI_BLV->pM%>Q($4zrGZYGL8P zS6Mk}gUNvBk815@+=b!tcZ!j9Cz`F$#%(Y%K=n3@jmvnF7K67Fi%ryFq)#IiB5F&5 zbkeU_GiO9@@9M4G$=cdreJd@jsrE6KN`Yxh9I@X>{Kz!LG~qEUEBhTu{(4WgtH#C< zTT$b-czsnXOrHplthwNf2$3#d+KkL}3_V@%kuS+znuXOX=%(Y)Rvf8J-L zjo}7V@{O#X~X_TH+Cv+^R~pPQ!{JN zNcdWNgQz+}P=S1n=8za)ze$kVs@*esI#ERSd3zo=G!$rQh-YT+gjWhRW9cWJb2>3K z(NN1P0irkV&Lp9)SLW(Z@%qEyu6HRk2vNU;7U-YCoL?YKGb?CvpdPlZ*ekr#m%eC( z33bjod;WQYB(8Vw7pGFv(*Xl}mfRvR;>%E+C)lR+uz41m@3L5R>`q;-(>1km`w_dl zytATe&?hSS8P_gF;a`fDuTPBb7hi)-mT5B?@^c{Q@&uf}u;4GQMHI?xVrG=nMpxTv znXZ`bbo3Eh;jfUJ?v}keSUdS6d!{PFX)$m9&WMPSconYKZ9Ln&+}P^AS>ZRcF8Sz| zb$TvRCtBEh8NCiAJtb)WMsT^DtxzIYYtLYJWq36-Ku!~^Z&qZT3y{e3ERp@{MFQfr z@-=qXVPRlzlZ(Q*69-J(ITItjGF`7R+^^>AP)MU>+S@!sBt*shfs-j}9yBtP;b8^1 z_!2~ki7_F%RzziTXki8(IegTpaR5s!3!1_Jb9wD?GG$rH-9EkVDFKXZ2GEGoU3wEU zK2GMQl>&}0pd1jISTSm+BGls8zW`e82eqt!0Il%gC#2rW;r4y{?l0D)g@zk86ZyIX z-p#1FO50UpGxc;h#?!5t1z4a*xL=oRto1~S2z|8>(I>p4)|$$(?!;_`VuwJ#G3r#w zszU+LBXz=Q3I?IUbfF4=#Z+7gt4Zzqbaud~0xB7i9Tfa`bnMc*A95(9J53N3{2npM zeC4@wg%bvG=1OF7;*8|zc0^*N^#_L*%fDVngHZjp*@A(()g5M-Kij`J(3iHDx-A@j z$mlnEKb?PPb+fcsFW^RhRDK+a-Ruq`IewiFezd+6ref{5A`&YBljOKGJ&t}C=lwOD zy-T5>zGlEQvCFbYOmOpM?_|`SGb$*w0L4d_A3TdGoeME-RIetP;EhRESWEYEH)LRs zG-$6sXy@piyLVupv#x-L@bMP!NS^yfapCOwsKpWCZ6dn(hkLWlamRu4Cko~e|U{7gF*WHNk@u+r13 ze!)=0Fua+WSEuIaAO`fr?FZb#Y5xZ*S9EM?MtGbP_Emis^^O!6k|zoU8_D+<>W!ge zI2G>s&pG7Q@aBM+_U@{?OLxoGH+yAN#acQ&H|3lE!j(}!$-Eh_k=*kzGd^q~K>M@( zV71)&Ogm0bxia8jZCNhUgXPp$0jbz!Fu`sy_aC%ZjQ7y*GF3X`WUbJPx{-T6dq=|a zN4?%CC{c1KlZDMX6~(D<*+Z_+m7Bvw!Vp%!0Do?Ed{g+_ov7eD4%z|mBJ%Er+5zn4B zwZXWh;JMsbq>Mjky_R1dJNE%NufU7EmXC+h`SmDqMpFL;rU zI2}V)Vadh3U0%c=968ene;`*`>w6$->wl>EiyH^#j0^w}Kb$yWvQSY$r!ODr>Yoec zL)r|#pMzR60_$CRB*!dSh#IF%Gq&jQ1h7154nX&lg9KHq`P0*k^pjI!yPT#v0|chR zZM{zF<*{dkHuhtNlf+MdlV&uRDypy62OGP)6Q6~FNHq3#4!G4s*}#CG`S}K|f-ob| zAM2d`@Vw11B0QW~NQ_WB1zIW<-4^VxyjQsY^&>U=M1&d`w_ihDh z;HN{eb1Wh657X4E+dw%Wn5<+$=4Sy7de5kSNPGqv3`p_vqnabcJa?i4y#eH+VtQvp)70M^OeOHOsjf{F%X=1SIv%7lQ zhP%!FLGT@J4y1=?3Nj>0%j~pnZ`mjhOrOCEfbjnZH(!xY-tUe#fJpN`9FE0}Dw968 z?wa@}>@D%U)1n;P-A?f~aUFe(DKpakql}lyDd^`o3Sal`s&m-ybiU5YxmQP)>B2LP z`?-nVH)2)yqk_5PC)(8**o)}fL9>@P?A$_ThuCEDTI=dCQe>(Vfe>9` z>n{tT@*>fMFH0a%^P`|(30`i_~D=1##(cgpViXF%X=6}E_U`ikar zL*Rfcu_kyrNpHsT0Z!(#SJLav{;0p7zwu&S7)L#ZIFChRv}^~3k~81$$?UFQ)R3r* z#Sooj<|uYufVCM>jaM0wx~i@O*g#n2BHIUffiB0gLbz%Cz0e{HMZUVTm`618iy8ON zijeI$8!`$&gNMs)!ei*EIsC{dxLfMdUDGjn-39YDJQjmdi)A&8m;QXIH2C$3@1ON% z0w1w4P=3ju4q?1{-goVG0f8b;eWoMVX@Hhi${y20CXQ z`tGlDg=-7d&syCh>w~MizAG_9F9E8dbFU<#vO=keQ z@zT{9^c+<04j!K>)Wb*va4)qOMt5;MuiqoS*oMj!NRmz$OS5VqIF^57s*o}H^pK&> z5<|(X49V*!4E)C6decfF8S^d#>h)qZ*d2y=vq0ocmf%Pf*kG$NNOphP0kPVSaJB9W z;iN)!{P`0_YQ&<7!;v;TZ#S>a(Ft(*ff#n(&fndai>K7*Wv3OEt-!XHPr+iCLYave zFS>K)+DO7JQDe<6*i}tYQb3&%OP|?67xc7Y$UkxEG}j8iqVtjMYZeIo$`mZ|Mof{;Z$VtQPBh zVJB|uA9-LZ<(EgtxZete!`tLDL|R%-hAd45(VjB~sXhb6NYNiLS^WD9D2Ag7%pAE# zmvMi9P%>=2VnywqZt_ALDiz9i%-|7qr=10IKTjmhGVW@Lt2TW{0Zx%UCMoJw&1<*~ou>Jbz! zpKowOX%^c=Xi4#shIjleEp_T*nmR{{!5&!NPx5eev7 zU06 zNM6ve-jR7fJi`k%)puGutZ0`w`zY!ihrmY$P<>-v$IxO!Bohxb(~D0+Gxowf5ejXJ zAxW3)uK1{5U45v80ZLmSER-GngQnr75yXZ^5{5%d@yxF7DC@EFCKv1mukg~G9xUBe z0;22lzl1Z7H>oK0siRb1!R%pct)H*P<^R{6ZP^Y{n`I2&l z{-!=Dhf6Joi>Z(X^2E^^!d&OsJ)uc`A+vmG@n$Yb>4@fi;{*GCB6+`Hn&CO_4rdPu zup`Co!4(T~C$T)N2u&lrdwysulV?ww$at!-50MGPUBIbUh(|CgE)6OQa?3UoRVhU!b0?$$bcz znMFp{Ppx;dwLLXiC5PgZ5Yu>+9}bI?XIyA!DI};RU|e$_2xZq?f=^@X+igk5oMg=J zJ^EI&wNf{NOQE+{2iWavkUFb3kLqxDcNV^SW`J>DpI#bT?Q5RvI#iQHk1vaC60vL) z+WwH5*+H|uy84=0b-(3n*m~`(mstRgi&iWOwSg%PXdcL)N|7Xm=hx1X@&`_h#d{L+s$aTba^knI**hMXP2Ndt1g=?LeV#|qfIn}xl~APy!Ui83 z8kki;sYfg*JO2Z(TLim#+5yNq!?o($w*@YJy18W%MHflC55lgXe zxd7v*OD&7_-}E}ZqVz>yrE?7pdZ`aOR`LeSMIQ4lyY6;RH|;1Csk3GFK;2MEYekZy zh3cXtRKibSB@Ci#s-YyjAm}t*-9@qQwDVs&DbL*j42_J?ikqDi8|#mDx0dG3#k&eM z)eD^|rssDm&s(CitW24Ye)OhB>;%~14YaHYd{V68Pe*#jMh7>m>CXSs580k$CG>o< zTF5rC&|}E(r=8FnOG+agh16MW)53e=JZ1ZN_I@j@<=tiW(B zJR%60LfbXFbZFalqebE6`ATuz`K{$;VxKc%X|EhMwkXY-c<$!T8m&fuf{fQW>;Vl* zJYnon6s&z*I-@z^JE_fFSu| zIopMkQTvq-Tw6C?wA~pZ&YTTLHqNHY(|8qSr}Dcn{Uvp7YvD2zE?;kksHxSzedEf> z=S5idlUjFqz;(MS$C*1^FJ?~b3zPnd#NjQUBd2sBD3;y7Ni~$?tPJQ_1tooU%(Kp4 z9DQ$}Z$aOBS%(U`{pOMuJA;s^TzUQi$qC>xS$xHu7?j za?S7wuve=49!E(w!;onvwbu7k=}S2y$vvFt_`Xf{@h8Xqy!%0iO}pXz=AI(HlsD=J zjf#$jIbc#XMLoyWZENeeeot1L==j)nRdNEh)Pe1kXtJ)8{up-W=d$rR z637so@>20xC0dvLlWID)i=}dRV{evD)TuhD(fRW~z!Bp$?3u9ex+}&j`4d8<@Cwh* zU2@2DvO$BehREaQh5G@DPTs3dlA}I}9cLmh1blRHHIX)OapudaApi%QR74(M3&7;vAd7j(rg+Mm#i4Ci}X0X63`>vX8~SwXj0< zjaZICnDUgQEH7MI zLTFwWBguua&UrkO8LuKa8pR?$Jk++Rm?LL~tiO2s);iRZl$r;N(;e3KiaoSO$6&VN zZiUyM5c5sY1Ri^XF4P@!Q|`Kp^-t~`GJYx2i39#;EZQ3EpSeX4SeJrMqnzn_J4jf; z&B4zS@&~1=OZZF)=_pB_zy#L8+L^%qcuyy^Hb}ed^=TuevU#0|k^$7&H3*-9Lb4`o zNRdVDPvEbbMdzVKFXPGMQ~biwxL!L}4T#Zh;Cav{Y}>cZtG^!q*oEw+?N(kK8|cQt zX+Gz5WU+CDJgwr-jEbtLXpoVXjuskVknKbOADGzks(JrGC4jvGT|}k-a7us z)X7bhW&mkBM zk3}bbOp8o$IdWy#L}^R+D73?|l&t&>Pt_KaSGx3&DH1qRHUFNf`AeHaC zoh;ShmvBujEN;3=OC@a7LLYaknP|*w=e}}lKmRUTq6E$s7Ji!8HlY6m9MrRu9yyyG zn{2j4Qbt9cXiQ+fkq20D`HuX#cIidYG33PGq}Djp?$gy2_`T+G^JUHm^e=nEicS2a zG$;}SOGs;*1cl~BEe@npuFd;JZ~97)&1m6FS?17u-%*VLBXyNM|Q!&(H4b}H{Dv(?V?RudG@Un!n#+tBa8|I8fEx7>rS*-R4Z*lZ+BHYZU^!Z|^ z7?#K6=v2pZKLJulJ8Ubb6aHK5nXhk7xXqkQ*CTzWLoZxglwIq+NUzXXTiVbKlRG0P z3jy&D@iVbi*Dx4*BqL z#s40nhf1di@SyokLaAwp#U$sEbnP;v2Z{CC(L|FVOAN;Ps;Pd9y{vy=%EmxPPqMgE z=R5a%w`{uSB7NBUxsYLlJ7F@xrlf~AYqrqBrwLbU%hG8uZ~y!{Bm+6vAQQ`sA>fQmRhP6BP!lOwxY~ z1iXP*bY&b0GA6dBs1Vq~L46GD>*pFGXru#giqs~Tmu36AJ??Y=f$3WN1BaF<88EU8 z2ad?`-H$FSHQxN-(%}Pv*VBFK_aa=;g-UPtUGhXufp6x0Z>6UIlf{}?@P`_47tU}@kBBjRt_`#4pZxXG2-i|_sX&I;sW zviz-A3#?5g-o5pM?(D`2SDlHqhtS2rlZeqSa&7~-+xc08$IzM5DH5J~GJ?ZBk;oGW zBuAY0N-g$Tvp;`HWKQQL8>O?T8cbnO&kqoWpnUyK7C$LYZ+{IK1rQ5?}g+7ds@(Y zxkQGe9slbm37lJ=9)&-7aw8|AkBUaW&>#& zj~|-L+91TA4AI~%DH-C?*mCDW_!u<6sh-yo^~XW!ZuB}OZ~=H6UVULpygZ;Z<&NK} zG5X7+N8B@$pn4!LLUFl7BJDk)S7+}4EQy=%zC-k;<)aaP`~hSMx_N_4_qd#zMFGO| za*;b@P*oH>hb|tka52L+gMVu3y0x->O(3`fH+b;j%~u|Yw@4u3;%cFkleK(j;&P_B z49Z)e{&!_|u}v7n0MIVW)i09qWER!vJ|wqv2{GOuruHRfz^Xkx;3{b}0ppPAUKHor zYHOMIcQ5RRV$G8H*q_R4i9E|vJgk^rBwmC$-%}PZidyTw|{2}IDo+tL7Zj;ak5DUI@!(h zFC!BRvsHY9mWNh03GBqvW&K7DfjESj1)RS*wBS_7dH${*`c-V~P;3&f;`Ea9Dc@w7 zuBRc8Kx1#`fK5-xhx}KqM-dSX-a(Y}nA?v$U>EagTU-9PxEo1?vKP^gyGu_$+r?y=Gu5SMTlz zGRqUJbhQTmWV%s6a})n$!=HT5PC?MyhGHmtI|kHrbCM;6}LOFABrbdOLYt(mY$7cMC1)x^}g8b2O$$PB|O#$V#>skx19Ud3qV-c+1#LI`#4J{Oy!mt{`oHMuSwk(4%*;;I@1DTdVGsN zr9f;+^j9jK<{{ncCXG?U`PijrormACtd@(3l${)H<0jW#tZ2bi4ha=%);^q`5Mi1aNK_=EiI9n`xU&u@dH$r=U zDRVF(hbg;i738|CT74HRI-enQqSR5jdm0g;ZjNmblxxU%Xovpv#aSf(vnK6?JC4PO zS^`3lLAz@(7hzu3--=*iptZ5u$r)22uf>#E;MM6TPI(H4@3=1NydDpPlRbW#Ju3qT zaj-?yI*!FdnSa=kQ%$~H4c-s^|)|f*%Db<0bsvwrl$g9le)faD{M{ua&$dBwyU)K zXX11o#2~0iO0eya$x+~)RZR10&b!FwB6rj~fD^>!g%50QZ?ZL^d|B}mIexA{vsms) zp1%{Wi~w3ybx{g6;f31@SL~RF`Rr&U>oaXe9d8IfK0b1EFhB+Dnwxe`RjEn@^_))d?VEPCVs;e z3)kAFLhCX2G$O~bzDoATa|h3wQ%WT5w{=ECEdXG)v3iF6*RRTOU0XIQG?r%P-hwC2(QDf5;q`{&QBVpVvtX@&|&T;$e6>zd5!jlQG+L6o0EoSfAWa@RM@E% z?z&e=uBgQ5Yp7xC2X2%cX`I4X4G8GC(&lcPvt5}@PwFUbVLowTZYk}rpgA2Xu@~go zSd(nGt-Q>oi*7+k?Coa)Eeu?&RKWMM>m3JLNOB72)xRMPSZe!<{NG<6qW`FlVFs(YwJUBaWKohNRZ7QfUg`&45}C~JH~o1)L)k4529*0A)Y~m2O_v9jNPSF=i%0nezr_7!ps|+ z@(+loIK=vs``AUU4>6$)-Rm<^hROwS~P0_+0m z(a%={VwIqZoYN%Q&#fCL1*Pyp(GGN>n_U_{1qpR+-{PoU>kxDGly-E?mZpmj z;7&}VFdpuU(T*WEVC@dBFd~($k7%`ll~L461n{TnEHL9%I@{~kb0-#qSM0Rxs$T^+ z%)B0D2jdi*hoLVGPF_ZCX%Ou<8sE&ZaH{`W@iD%YdeI%=uqZeB!m8BNi8;4?D?zyG z&iO0QBg`C$$Qd7Qw@Q`Ael^g8=7w2}J#LT-&58MDj+>@6mJEHfO*Kb>efjQqZ7CJS zlQ!fycg;TVfEX}H4StS4Wz`PI{2J~jUx$mEwYqjSwsh7Hyti2K zVsrt1CbtAh4VA+5y+a5fW_m%*AqAha15pr4BRB?G_PXCDK}8`ys{qB(MjgachKOI3 z)Pa!-6%Y^CGN&!3`GDJkm7*uC?8bAawFn*F!ojrRRkoq4g^?+}gtN3t_ZdEf;qQXL zAh!puli%3Z(lRQie5bm zW?aE6D-CPI1|wdWb1c<82a*?OZl@f~g`>%YN*Ji)%EbycbBKCKWQtQLJ`GG>TXl!b zWzd4VnOW^uM=*xmqq`%)a#4}Du@@L zqfyK#HIJnR>-yn-->kOevT4t!N6QG4FUD~=qWX|M{L%EGnYlIhx8DDuAi;+r!DNAf z2cZAmu#}(pbao0EM10p{bB*8L@dnqO0;OjHRs4IP3X6)gcE$#!X!e%r92{!hZL9&e zNln5;P`}2MZYp0Mwzs=7+RJ0wKd5RGuWVw948Uc=*5#|LtJ4OGC1R7I!#-fYG91@ef`bjr%y`9f zN3hIH(U7w#FD666vS9=}SzPm?H8~!E#o%^rLctE7qvXi^n3lTL;h&#;oTv4RcSl#V z3vBox0>+=6!_S#ht!qAI!7l;#rXwk}*iE-3xDn4@JLsm*{N%S8fEL;}F`lEF+>n?( zV-uT zQMiw{vOkh6Z6ArS>Sl0@Nxw*jCHO8m{7XG`dRCknl&xoNT&`KQE*+U?COJyEfQJ6mS(Pf!r&z7U6aCe!HeFH~3c1I75#;=Lf6BV0B_0;eU;$0`i{ z`b=S?!y-$xfneC6gCW%CMnYW0Lg%1M4vLk%`ZddSzgqs25s$?VP#!v{CO^58RZTXz_i;%UP!8 z3y8FXez<#P!5en|tg={@DUgXRalNG|SDnWGj`dv-JE@?coU!R=w7vCKqs7upicka_ zk;zxxSj2My?xcnfdV;0Z&ck~T_trSIKE;_w{xxMc3T9h%__z!QO3c#|w@^OkM>+k> zRGLosIa@X^Pv(9%6KzyVuTd4pw9&YHtk?M{U_QX0!cjWkFd0hQwOC==X^KqNGE@Ad z94wTCzA9{V23e>;42%h9_sTvJR!6!m1nngXQ&at9nQ$#CVwf7D=1ifV#LTKE*UIBd zj_;JafqU?@q6*2$;<^IFoS z#eob421u`F&o9VSh>m_{rytz!i|tADLeuqBSly9 zGYW$rPK;T_7?{OPbTy<#_`EGEL~#-;oRb#YVY%to6Q7ZQj}W*dFs9I~Qq7o*|TZG(GCou~3+{ z@zNi=!gcpxog!jI;7|1>e8#6_1bsqnrYh^fe{>WQLO-h3+SKG!XB7{z@ljMmUiM$a zm$RKp?%^?S5J&)Z{dgbp2iOi4OMdhR|1wd@<;t8Z^DRhBp@ZS?!hvd_z4PY0M{51y z<{pb_mGzGe8-4ajfs#F+lzAT>;*2TJQw?sBv6b{RT8=hr;lFDXG-Q(VSM2Re_s*~` z)7IXl*XZgHGR7fs5+ZeWLsL+ffrm25T4+cIs}i^M4}wuro%IXPZI5`vOFm1n?gM76 z($LvPZ+Z5wMjSt6gP0&`l8`NpW)6d+!M~ne`>44;)42AXK9k_6v8X6JJGClvYXac2 zcBwH!n>^bn$(eA9K6=`>hyv5;%VvWB)u^d)kvZTuv={Tvs{_)Fb=Z!#FJZg;6~FrM zV`;J1N;{?F;4Cv%%;#}Ew~u&)?+vRK{%WZ__SxBbVJs@y$J!|%1UI3d);gzc(don8 zmu3y78JmIucop&?WVRhr-6bjT8Xz$P{JArr%X`PrwgSo%FfJ1(tbI;JRhB=TB6rC+aZr!BypUJeQcUTj5Lhs95h-e-L|z2 z+MDqg#1b#C{;dkq>MEzU*Z$iCGv_J+W{lI73sEB}%v-xk)BSFF5iwExQ{Ri%%g(s7 zaM|JMI=R8X*HIi#FWlt$DS;L@WRA4<~utM?cCKN>dXZUj3 zCabNKGp5|3KcmZ-r8QEBmb~n}6AU+GPqX6l1ZR322RS}Dn~fS(Z^=*lkF6^d#iMh{ zqAZMV&Mf|?NfVureah};LBN?IUZc3-ggCx8_Nx3GIrcequGBn4YvGyw|5<>QqwvZw z$28*KWztn(+X|hqZcat9o4@c^@u(-k7YT=UdO;{a^0ugSC zM4s>Q;+NuDbqFGI&_T=_wVWpJ!d_2V2GfiR<#pocYydo)%h~iCGWOV(f7UP`ID+xh@Uqu(qvdMN zqml)W_VwNtO7^Cty`75R-{yxOw0M|;`}W$-STVRvoyt2<-Kwa?GciXh3EC(^y=dkF zXR@)tQ2rW#+~FhAc9!CRb;yrri632BK=QT0cM=K$JZX4(ZdTVMb1Iin)%rZMcn;_} zIQ4ixFV&nTy?Fouv1ZV$z%G{cf50eoSg&5>tp!* z+-NGfVa*YB%gpDUpdjIk`rGZXiaU+w0rxY^`O*1I0yQqHwH9tlKm}anG`jeBAos*H zrOnBl^}rY;s;04+YfI3L-}gA~yJu^Hi9!)7Ei<0Q)VTWeR7Vq6AvM+pw-22%I7bBn z(Q)JRm{OS+Yj1sUENAH*3-c3T+C0X4h`j5X04w6_KL#5^2!1D70u+esw3-MvUoa|f zaXcFFlrN!hS%S;M)ZMW-o4oGA7HJ$*pd+mqy~a*%y*s%*arJE$0xadt=MPz|&u%Wu zG3T|#XmC}gSM`S@OyMkA=9Q8>@O}ICw2r5SGw^O1b!N*W+cpfq)6bIwTiG8bnJt0hRSzT#-R>J%>tRCSq2gv#=~Y;Az==PYC*X>%0j!8{P|>6 z&(h&cgAh}P7Pa!iNfQU?!}uP}Jm0pSl{V$H_W4dd^|Tq2W9F6?fc`i;48bM)@AE(H zDAG2l|B?#i1W0|UT7XYwyE65P6L#Cuqn{|QjOrlXzSQDz2fMF$Q;TwOU`Eho!X!;DxKi>6;zM)?VfKoP zIx`EfanY&F#w7yULPL1EFv{yc;pDXXCq62F`BM-R0OvjYBMSR|v%6e8oT@i+HdmS$ ze=ra)G>pU+cxJs^#n-XWdtvft&-S#e=xE0O07Ur_$!sTW*j&PKv zzTV6$ZIiSwkp`ljd);ZQS{`zA-qqo1-<~$wy%Muta127Mzp8zch@)iWy)+(qTB@WZ z_9FZ>^^W_m(?BTGjKi-5hA5SxNx#{81G@=|Z@y?hA~0ZQh@}Id_`V18d>b=jq~kE3 zUvkBr7Pi*zw97m;B$W{$lPl=giIps*s#Tc4qB0?N4NdAl^`38!B3GUCsQwWRsCD+glU~PFLTIt?*OOczgA3q z-^ZO5*tmFtP?gCGP-F*Jd9#AXrnczf%~Za?RtM0fuLr*mI6+erV8|?RkGM0SzlSa! z)Z6ZDr6}w;??kF--3v2iPlt4hcdi!qgIfev=_3=k_4-I+%`^n%#ULg;p?*F%Wz?Bd zAVhz*eEgEOWu1Lvy@zB%Ut zzQt%}olB&>p9V4hXN{p;r;I*mH|~leH&_?3bzL?_+RvR@70O!&?s+8T{;whkB;?h2kC;^+S!&DoQ zBcp%2O1qB?pUXWE#nbuiAkAvQ$I<9{&J!f5a5)!q)Gk{_0g%d^2#y*EaeL#-H*Y<> z&om?uzf7z-XS`g&&Aa(R)w zv}BC_$_{~Gle=W^4fc*cVb6DEm#=7VZ;$f_jyhC%hrWg&6XPnQByQ+jEau~^ZTGvR zG+U^iPJ9;U|HmG|henDg&%63`B!4HSpw7{o7y$q=Nz%mX|)P5Bv7Kgz)7G;}(X3 zbDLBaX3qYz*z;!*L1u9T%wTzOX+e6i%plw!&g*r}h_ zj-GdyHl+@@OCx$UT9zZF)LFMWk7UFFhKd$IGe4%|Lq(Frk$7!wOzl){BYZhOtQLpf zG*`^E*H57Wp&Wfa`aDe0gUfZ)$D50OU3^>k@c;>Z0y;erC3Le=1V4{GoL&VTTiC33iv38_3c3c zF5{ig)aNi&=HqWGE9o=q@jE*^xw%Aamc{XzOI>rGR}a;BL5Qj$+j=TEwrpBxM~j!| z!QX?0rCY!Hxjt0AZn~@yezCv*wF4=Yy-tDYdBk1RS0+z)L4LJcOWoklI?#3T8P1F8 zW%9ye*@n-Wsn3#--mvFV%E68Pvb3bGPUINIO9R5dNTP}sk3bP`Md7n7B$!rr77iSh zh9Am3J9gxSe>Dcgui$OwM+~|$B>0V~2=JN>q)ew*F`CQp?ehjiTqip8PUgz#h+(=X z8_g_2&NUwO>1M#Z0A~FMuru|;YUg{mmYgr{&J@*K_2J#U`hm>v7N)R zUr$mbX_P5<3O1US=o!E@LOy)Sk{9y8QmkJp|1EPQc5ek|wVtv*=x}0%SuV}meTkWE znJ3no9NYo3bQOBP;Z$qw^*aJtOo@xJsaM}at@Q)<{n^^|F?d8h^irxg3Hdsg z)%9^xcb2ysQ+Prjn5Lb;m(8FS`avUNR@(1X1@;@yo>8QEp_Yf>HnIWX{M@b7aAb1K zTuT=EwU1a)s8Vpn6L;Zfo6Z=&O5P`?r~<1N4-#?tkFn-s?>K*zBeO*NE^BQz?#Go< z9h=xim`EcXH)wwF79DY6X6md2>pVZUd=2tNjUB?8ElWU7XHt z|5v?j=cO3Pz6{PrX7i1skb1ROr8r%LuqpcPsqKYuq;etcz-?yno3(|(q>rCPHsKxjYUX!>SoR%1;ScO(_FR6V(q*?DxdS(CvP(wUADaR5Y>x| zeNT{~#Q*HpXInAfL~_jghSTb@8uD0L$?b#i=5GIuZYTPV6AtbG=2Iu*MsKlqwmJAg zh8e`yA}wBa7V%<*L3G#)gN(HcPdWf-fk)N%jV+vWbQ((7xSS2AP4^>woyC$3@GSf$ zIm7BKPTo!k#DpJX>i3Z~Ts6C?a&=YUH&;u;b8f~`#U++cykECbzm z-uZ>ojg`!I;J+MlaO`iHc5QKRAo$Zaf-8}2EA9;61TI0BG_}|1K4&LDb>*wuub%p2 z&*8BdPF5QS(%XtJ5Eb-l=}=X4usA226R!)E>p0{|NOT(02EJ76RCk8Eoq!H2`wL{3 z2_p)M@urSI*zOviiY~xo#1&I<(kuS4-&1=>k=`M{?GOnNTorEdAMKpdDRlDmA%#7)~s zZH5q6l7^L}wL-qkmFXW9rPhnp!<~X~RCP2zO3WG$$NEjSD1@=4IyjC^!8aNxHKD5E z?w)%(`%gm!Hg-tc`m2nm$%wU9ks^iMZ2>iPd6Ug@kRoWwSAdY~0|o;54CW%X?)63u zCPQ(&hT&mH=e5&L`n$HF4{&U#DjJwwc;xYc}0 z#Zm2zR`S>B4Kvc88x79%t|#(HQeQ$16x`{OzWtDP5H%fl3#L~=XOc@!AKHP1cX+T@ zl7kcqM#Kx%`$SiElI?CSaF{IPadgqrK51Z1UusH2!}dix_a4+pVQMC{Fd;T>Y;3D- zXpNc9%+rmQKyUGU<;4X+rozr!TWDpBZgzdn7~Hf^{^P-$BT7Y@c|JgAN$p$nqR3}Y z{3`w`g;JoVNJYAmd5+{JQ-cOy#5Av`NO85rSRn^qs&+U@`;kyIJ~bI4L5(7zNA%R} z=6^BwR#9*+=eu zzE3qqRgHeBRb6Y&wdOY)M3zZ62J=T;td=$#P7P4nfAh^Puag&k{Bf|q?a-AgI4JyE zWwY1h&HaX&u520=j{eWKCdZwl9T!!D=Rq5^RMDq*I*@T_sVXZ4UcaHyOc`wmNUD=j zXSxhfFwi=?^Krv3sc?mh-SIef&ZyTuUx=bxV^WhurTp(`39(2Ye+AG4>XaJAFZfR! z^J6y^;NK{r)Gysci2WugStC#AsllNmbw;>}#4`xL6Fjr_l^M+|&f~LB8a^jl;|g6- zC82Ok3eu>=5c{>uye~}j7vih&)1y~fI9jh>TSfMf=xxY+H&HX z10rK!nqmT&8AnbG7x${(ssVSIeWWHa9fj%yjfKTs4Y;odVLguw%}ol)&nl8kifT^l zyYAh}Z$%m-A;1pY}&dA+?2s;!W9K%LF?HeFd<8EfDlFo$(6w zb@aL@x{JPNKnl9wGa$OFynbsEmkR@UAF6a@OR&u>FxHk16${J+4MZc&_Y5kN=Gb2t z6=Hsz_G1OV$cjP?#@SaJZl2)AX_zZTP7D`n!3WWB(q1XGVI}CyN&i=5XD^GVze|+} zojZGc*-TM|{kL~k{$gcya_yXc#R`%Czif3CfRmaWf6a5708n}Qu-3kW9{#_;M6aKW zzq6$`s}B+rBE|VO#$_jBnC)PWgxO!g!TYUM^3gHWJK0z0I$WpVYuS?d3e}%p<$?{L@DE*Ywx^xNMLc!p!!-n7D;#t(z+c^FWKI&-% zeJ9A*h=r2&9mxEjl%l80fRuMLcz~E%>BB+lq{SIiaj&%-BP}eGmpgt%zU2pc^FZ7K=&bF9+sx`A zuJ%yIC^lp}UdqPfp_UjHhoG3N7mZC!JEh)N2C6Tm_g2I1j1r+>DzMW&q&Z6($;plV zxLbl%6)@ZpXlG*RSEeiT)`^r<7R?XtjKSEC>+Amh7iI`zN-G^d@%vOL`6-U<$QpO) z_!r8gBO|kvAXX8qUM%lfbQm@rPZIIMb*(LI9`7=PCw?i0_mTMTg%5O~i%CrYKRO`| zm$RZbd-2vu9_HPikpVdQs#Ml-HUOTcY- zO)!3)L+!abc699CaeByYa!(6Px$GhI4z%|{h_uvZI$+ILa=PzU#othxB6!i18X&2U1obbsQ2TVy(LX(V_HNB^eEy-)hVQH0+K zRsMfLkQ9pi{)Ql>x{$uX{7(o{s^)V;j_2MBC{v50VNn5m-ltCJZ~ZYmgDG@2LuFk` zH5yE*_}F28BETXr@xkW*8-2tXg%#F|)Yig%bNX&AlfHpis6)=-Z}0GtsbPIZLEw*; zFI3GlrjyZiWr)4@3%cJFp%zA0CEezLz0C9-Ctyas>|Q?|uIvKvU&YBxW}f)?_-75A z_dd9C5-PMt+n49o??vh^uuTL5!27p>`4YnIiR^2i{RJOG@0^d0gi95QbTqyJg%#^% zi$s?bnZI8O8A@%P^8ZS}NakJM%Hnd~o=Szb^Sqm2&$ztQziOjgKmG!Y1zh~9B(Y5n z6fVPE2Tj|z788<-JXe3se^dOfe)$ix*|7*5?SxcUrcx4db93VEbT*SsPX2QCtbdO2 zNdCS4ii5O7<1tTxx^FJQnfh;687&%{#2fG3GWs^lDc4%7rel9B?)Luqo8L;qecq5n z{SU(!(Xs7cyVygh1FZhFo&P-}{U6bZ|K!z2R@7%;XO#MlJzu5?9w1<5e8V=X={QoZ zWfail4A2A1abv1~_q0gsdgT24Z+ER5v?#|tk{sLNcC}~CuRSi(>$T=7#FKQtb9rpl zxgUx|$b0wRQhQa{(R$k8wVXJXW(1eq%6$IvGw5mwGuo)4vX*k6sFgwNZ{=WjF|roKj2pMLc@$_NN9T_eKymT#f2q3n{6I@+ zYBb4+DIea`yTD7w9x;iX>h!?dsK^ek{tTTqLG=`6{qF>dN4u4)2L9P1U+Lrcilx-Z z@Cd`ftk0lV7S-8EgViePr-O%?LRnodlcO=6lil4;0uSUrX)JeJEe#V{h3ou#9*2kF zrAe6whZvmB#|=jNexcQS(80$>m=ZD~h)Vhsa=II|!vAL%G@%F=| zd>f7ds+VOgi?!`P^W`(vYb%G_+DzpgaXOrp1uX-KI5U_FjumC}R~er$gBgD8KK|@o za8WvIEj(^{-;Q|VSL%|nX&<88KFP6r>1yU&j>9?ttX}R`^!>c}+y`yr$67x#nj7bVw#}HW36iEoN=7eToQm0@mOTD9TE+=1Ai`9{Le8 z%B}N=*Qxt!z7}~B3Xy;cbqK=)N)b9-omRmoD+)f2ia`nSuZa@F-s8Xivdq`^>fAwb zJ=vIxRmsK0B4jzo*wk0mjJQsb@j(WQP*9$j!nE}C-}VsB|F|5^bD6YtK^9*N3;qSV z|NeaUSHgzn0Tg0^#lclrjOgT4OQh350o5oKNrN87K89OU#yzgzSm{N#dg8x@Nr&6V z=k`aTq^{2Gut^kwUAN#tq|Ed);>+gye{yL;sEESrVwa2Z;q61xN;`dBLN2B6nNKOZ08Ts#c8jo^{tPD5bWLdY;vwM_q*-yt@ovt^) z@S{g#{oL0`3+hMaQ>FTfR7;zs^5>b0OjmoNUZ>w? z#|(9CoXg7FoK)<)Eqi?v4V>tLP*aVY(k*5tmIjtNmh+xy(+UC&o1#J!2(i$xRV*jV zk*~&v0w~W?8?5w4R>+u%%^W8Z4I>R+(K(|WIPo!$O9>MMpLaUdQqxli(qd4v;!=|{ zAHe!*-o%}Z{J{ZUN4e1<`tjzmw6f)+&%IeprI$cbQg6|J`ry=#7rnJITWnxdoZuc) zudRTE^ms$`1WtmY-JL!uinN~J22xEj+5JDD>$DIZI$_gB{4%M; z28@}>)5d)1DKonK+2fL2EmmG#R*ysCFix>}Tzm^qFonnx&?Ua-IxN!al>LgcEZ+4M zGx^F9Y*btH+oU0q(#>%`X;8rWW~ybwhb>AJgNlvvD&tRJUfwT{2_t`owV$h>2R=kX zM;ejO$2NZP^=rm7-L`TE)v)H~h3I4cCtg3nGopkR&|06lq2w@vtHUb&8t4~qwEmkV z+R!ju1eN<_r!q~MipY0WzgX!I4k|;NHRZ=laGbXbWI&X6;JTzA4cm9n7xhx94)Ibo z6rpdVEJa^atB}J~0c;Up494O#q|4%tXPr)F%I#*xGqhD05)}%yM=&LPE$daAF<*&4 zHgV+(8O+wI^T5yVBU0|vco$Be15A%oe`*D9GAX_ey5Fo_escw=YOUi>v)h`+Z^nc2KE*jh2gNKrm*)AGv25;g1gTiRge(P zfNRTktTMC--y4*^ZNvw~4;b_eQHDQkzVCL~!NAmya<#HCG`D$n@M_?kTpp+vULHoj zP<_rSeY1b>0f?+#!{@F7e$hqgiVxi!#_d z%`{bpjQbCoReNtnzV+V=3^%3Ep#OwcxkKyyza&=l+)lk>XY}+lm`-l02=3RXB zlkZ~yx!AmCc2HFdawjZ_U-IDlEzdUDEk=tr=}RFcvI&E@PQ1l~IwDQ6*%us|2QKP8 zS&*f!Kg@-(X%}sn6)QbGyn*3A%MOhOQ6J2g97;_vRi^#BK)_<9E^IYjuCS~4s`S1$ zz^p~$A*E%LA`K~u@*Mq2DAoX*6rj9H3i=K2w;ffFC} zC^NW#O?6Y~ffILP5-G|Up`n}^Aor`+ogbkv>yGcQ-d`-*2VjWE-)3CCQuC*;L?gPId7IuE~vWX>=_g?@nF)b7q|h`7T{k zDR+AjZS*sWza*VtS6#_h@L9Ir+@yDYA|Q-k;MP=`50(tY|3Pg?8;29s$jNdbJ0^N( zuw$Heu#tjAe2%Uz&o{3k&5F+7a{H$kc+$wmf%jCn#&rctIJMLH6OSQoT|%{xR5X~O z_0eqoV@s(hQPfy! zGVTG0mBp?OZ=u7;GDYUquH#YP!{q~(=q(Jy^Vn^*V=hT@h(GoZ7c9cBCN$L9B+i*` z^*K4dIYkG>3)l;*?i84YSR@kk%WQ8PEgy3Z4&B#^eZ1GB>Cf9z+*o*S(m3i|uZ);d z3`4En4y7HZl9;Uj9EwrDGd(S&2)A?HrQX3lNFG;CO2FOmhaRltZ zQ9LT^uoj#Jh`6BZNH^aZAAEyZ+uFHAe()9eHcj#zFr&{}ZlDQTk~vYPoiQ?vUIdU?5tz zI`s%GyOG?-(}?!bEU|r-5Egya^o^;mAhUQwm8B3uI~ThD8DqR&K222=z!p`ftE@Nu za!{=M29xYjgI-VTT-(12bm;XmhYY;{t?hQ~o(p1FdR^lg098lA~* zVkNYh@REUC$uj#57VxG-<|f+MpdJnH#z{rh)EjPx!op;#X|h_{x zQ7;;|aCevO8l&wB`#{=&2m2 zj7XH>oGDw{{VuKGeJK%oefpTI{LxaTc9f5nxJ0Ev^FZ19@hdXeg!<2TGljm|gpzCq z$KYy`$(PlZy{+4M%dNLm#@3-}Kf+y`^%0>_DOKylPn zG;vnVBYh8bS2`ZQAsAhCKK}Ooy%<4RaP5ulkCE_H8{p63F!H5dOLmb$R1}W}oviFKfHyh@G`~n=(1RrNAEet|YxJ)P7{bb*mKNh& z$mDlj5*zvcxOazW(fYenVEg1AWFqZRM+%K0Tr=V>)b;=R4SjdJ-sd#dOdW1<4-Tz+ zOH-XTi&15v%V{cuO>Nx_%pK}V(`Wb21x>JHLdRO(PXd1XnX!?oP0S zbUgZx0ACpxlwDqhllrN-;1EKG^#wR7;s$q7@$Jab#N61@Yi}mJfvL~lCbJ>LH?0M) zO-|!CeVO5oGwW;k4Pm1xsxIeibFpqD%!k?cdzjIo;&-R|7d9iKi;@$oHdDQvR)b19jgAtP3v1bL*VfwgRw=;xJ|F3V6yKhm z%Pf2yR1bau6T$EtlWPh8$r!g5r?!XJ6eiP!-_c1zJZPQ>h z=A5RJsl4O&puV}J=g%M4m}WF6TNQL$PQ5jU((+C!-Fp9hIIGtXQfhS@?{(CpN7)!fKxB-F^yJ1iA9bofABI=Qw~j)JVe1j@9Bm#T|oV8MEgZicS{6v zv-=Xi8)ZcaLF-P_$tA@}QsB8Zl6<(h!GLEbX&ob$0uK3*@fYAOuC8iZi}%(a(&FrP ze~Ca>S~5lRA~Yj796s%Pb|;DKs?c(3Zu8^zSbE``im`FaZoW%SY2C8w`eY?fcAM{B z@yY?G6CE*m#*?zshHl+LD~+`ceSX_~I)#5XgAQW1TLx+Md1~P!V!!XIHo7ZEUb)TK7&?UM#S<#D~ixqlye6f-epE zU>FL-MonG!a1$%Qk5jsyuGuk))*d;^nm0rO`OLH< z$dX?_@N+8m?CEBT0(vtgmp-b2AZbkCdylT;>9r`@zr{c?FLeoBtcb|^aX}ciYb)SM-$w4#-wSoo#S`itp z=-HTa@VBhz1gNdt4c=4K9F%)nqv$T_8mKxxyJa5z{)v6kI-rlHRyjyGEPh`R9E??T zG~*O_0RX6ZP7X_(h~qPI9v9o!BcA4^#6XS|UN@O0KRi3!3RlfgJX;}--8Vm>P?6jz zM%eD&K?RpWX(kWLaQS*3Cl%Z}34dgDZ(n8t9#JKC7Mhq6bQPc-V=A(feph~>_BF2_DDj7wy7BS4j8Tt@^4)*Vq1_r(Zhv%b1hyB zX11hPi{kJX-*Sj5alaV1UkB8E7)ex0(BZlmT+B^ZDN!+3kNOR5Dk{u`_eJLOT-^6I zKpNiCa{0mON-iW%Wv0`p+mXA}ktIfU-hA>_x%VwTGE5I0N0Ff1Dkj!>xYx@{;y~uK z?kJxpX{n2HcvG|DiWzGqBkH>Rz^-PrL!iBrFO9A$!@%7bKN3mGl5?=ea-1qP8#6{V zi=n`<>er}1p6PMSiA(6cy=s+`l3e&?3fILR;BSD){v}8b zk#^MZSh0+#{%WF*q76Xw(gfvDMB}}$me}bC4%oC@s~KQ&JtxFm1gA{)z}YMf?@)py zyHp(j;MwZ=R$#Q-aOcERog}nu4=LA9A5`;MX=r-^bQ2k-+hq74R~^%?BFu{Wjhj(6 zsef(A^_=iXi$b4`)6~3k7k6VW@jKwu`V)XHyiaLZb+E1hIMjW-x^*ugO8{4YUaz6gIU0`HqJp>Zv^3`-r z{nzZm34@vgx11Q|34$U?$l$2589;Oz_q_EjzoXHbLf=O45KaB)F(nmBHn=Ozmtl&I zlz#o|o#06&Y8%z=H7%VUoGV@G?EMUlb=PJfw2f0R6bvO5e!1BA08FU`nVXG6`dDUW zPyAu{ovKwR4eMK7IsTSjtS-XBjy^n| z4648$5m3w=&D_8BHbf9;l+qCuE*NnylKB02Xy$oAwYNcZV05YA8r`ryzxNnO zV(-QS9ps>35SPSEhm;lbKq1laao&z&I2u)~b=R4H1LT>Bsa)zlR7$~vzKXf8*SXMR zeo081hub#04efZE@4V;^)@9g1yWyTar1ob2y16(zRlXa3$3yEaXf?ugd=3q4yi49_ zVlBr|Geo~jnmxqu*=IFiZ*Pw+ZgKFjRs|W0PSJ2MNLst^&l;iH4On(SW-1Z}6*&ht z&vOv-cG#!0m7-xT-!bO zttWAy%$WCr5$%v@qkBHD<4uCc#BI0|47@| zbRVu+Y)cUGrEn`}RT-}a5IrBY0h7G(BNW-^U{w49)r`4YX`K=5?i>Fu<(OlFBBUn< zGVmkY!TihHcoe*7e0WV@d}Z=+5TWY6>9DPcBOwzId@`7vt*Y3jcxDls-6K|ur1x7P z4i3;XvK!bmq2HnHVb@}VW9{)vExUhmYps_ArGu1BT0jR*PQCc*5#3)UL!V8~rDC#? zO?&_`t>a~-J$bGaYixO8;!)+&C?zrwMUO@f*X6zq&kN6IrEi3E1@JS_c|~UY%rq=| zskjb>0X({LXWeU+S1{gqr8S6zKmmK#$3X-==hXojZ-LbV9pz|y;;=ROCj}<@7_gj| zJYD0Jv|D~1=JMFft#*vloUkci?$NB`WXyy^o#1}8iAF{e&T*xVqnV_9wvDj59&D>T z*XbJ^oPYIJR^i=#1?E$1)DA&^?J-L$?c$X(0Qd2Y{hCRJid+}1sPi&nH# zzpqaO5$%@aZYmybUx+^)Z`>fN(K8V~uJ&Z5q;as@M{1Szrzw9Qz?`E_Od8w?X3%Si zeN3L%{S}qLY5P9UCroOw(kaUR;AH+$s@e9`Q2CAmtB_-5dFS3gD$82qo>M(S+Up@V z^O8!TSQa_|>&oNvN{V)qeMs&uf;c=L`>~Z@?RJK`R6aD7YGIlh(4wTx6T+KnO8YLe z-5n2QFxRw>evG#ff4qhR*g(jgt5V7j2tC>u!zbc?axuqQD8|seCX!ld{%A;f50&2J z?6DhVOf4FxLk~lgwMF-r_seX%g-IDcgwN4g;e6wBys)2yDL{8|@KJVq%_rhe8)jI{cye`WF#GEeTK)ZoMz%r|=nuQ|Zz6CYmf17SS7(3y{uvMs-Yt==q(>0P zFZp)cPcv%{(yaClNRMT?35$1Ls!;bI%0K55CJ`z!#epCA$n^GHn=A*NZU~^465Kmr z?wvM1uCG##pYwQ8btv>2GlEeW+D5_C{lVkxn0xJ~X)acmJ!=;bRcOzKaJ^fjC%kpH z1?$nVutfPwn%da5BjYVD!#{aQ77?>$!~pzFlqM)YYkZe`dwuC4J2*W*$+Xp~DLKmC z3v*_sVt+oN^|=s4?UjRofcP%J>72OxWc2|8!Wa0V3hn*WB=Ub=@jkm{dp`r=30ceY zeh0+M_mfZWhwG33{l+i<=fx^+{w~k}+L{@>xA!~AN7h-+RIXhId^nddvAw9NxsaO1 zgnco~4AGJ2nf>iW*GA8Pm_+(z=VK_gOi)vm9h5eW@GHmb;DbxH2NrLy+y#82Cy&!| zEDHk*vt;WFW5{&JN~i@Z8HvJ87zVVfldXNx_asONZ>akXPSfLd%VOkrCKAQkpumlC zfa{fd@tkRY(AaSkw3}0&^qa#4y(=GWN*lTleMXx|(u=^=MrZ0rWVpl83A4A9kyt#J zwy|*o=9Gf|AYS_5A!FEkUg3}4Lq7dM&|=WfNx&L!{i@gL)2HiB2;VHisHE-0@}^{a z`D~R<_WY`B2yyw=e4pABywCUVZ_iw64_5grVf=5U;)BgM2NOMRag`7gJTHl{OB z+~;xrfKR8nEa$N`h2vd5domf}0(QCLWpppN`7|qEW?RQL7(3j>_@#kUqWY)Z*U++i z>uN;sPqQM^mlfnqbJp0*tfM`%j@RR9j)&{bEtU_NFmT*g@oujamdmj-w3tri6ghXm zn&6u>jQNVX;54QD>DPrDn2Q{Pnq=2_?Y85MmR87Sbl(bv;IGZdcwDt+!h(U>j#KK2 zK4VCJC7$N4lfECkU=T8wCvtC#J~m%!hjY&o`6wlcaj74Jz_9S}Ow7d*4(_LB-cB?P zl!ay{+Z8LrZMQ@{kDFtjjzmBsKR>C+hRbLU2hRhm&TW3zTl?+TZO18}a)bf7`t5$4 z42n#9fC_ATuG7U|nbBPi#WhdwYFYq;QoyR=M%Jo;Q*yS=d!#FWFnSWn3jXU1o$2uT#r66^< zxwPh#FVNR=xz^MhUbAedaJfrYAm#*EbS&AW-L`VKky%~bS4pc`1`F9qzkcI}P*%OX zkZ*D$r+40+dw#Z){lij0xoN=H66urV1_vTI*mt2yI%05sFM>@*>3A6LwrG##a<6Ux zevh_JawxJ9i07l6*c4X8jAtVKBR|7k?wp93K(i2Z?|eKxD@?EcYpwiZZ@`eb4|VZ% zCh33#q8$>83C$?6k3uihR;P(1kovvWeY9yZH~4J<9Pg~>`Sg7MD1A5^mW16T6p*aF z#j#BwWYt|B4@Sc}_x`EiR}r10e-8&JBGKtx#A-3r73$9V436g@ln>ANLzBh4zpxZ& z?Rc17hS$5++-z^6V=%6N2y3nT)a7kD5EyY?qaBZAb$11(UXrT`7r)*cmTOIMIpjnw z-2ZeBb$cDX;w`*9!SI!a^1MGF*cA`B+DSLMUZdpJVy}i72>_)EkVtfHD}fB9y3(3H zB)Kr{dYj4->RzwEqf~h+#N8&uSmH?VKX+e$meeA`UfWb!57)hAUtio?iE{>Fd5jw} zEa55kjC8rK!e<9(_n=L|!?gFnAHqv_Q>S^F$$SxtYi-(Tm;{kF%;{hdXBM9>vTlmD z;|TsLk0GRq)Be)BN7~)uh>x<8e>B&ZS>t46$EtbP`kOzgk(!cDaeP&MqIvG+#qHK$ zF8_fr?fBG1-?F0($<21UPBg<5SLC!Je$rE2TW5dN)S2Fc*bMdTFKOu{j0C z$f1QtiU36-v^4$kXv>WRS2jT@IiT^=Ga0CVQ)sUz4yhqKbTqZ!wRUP){&VGXdgmw` z!(!kaILbDU_~39L;1sJualTffm{orIODexSX6VNbMp%IeFlNx0vy6sTvTVLm^G_X% z_>3DwdmeEYw`9pDiP0^tQey_7nEUvTga!6Rj4UdBz_^@6@~ksI*DIiNH#Aa{K!*B+ z!PQz`!!&kr7uL`Lb8$&ZS#je+=^2hsW0O1HjWX7zyPkvmy_t?9c4vQo`E;$u_7`5m zE>%;~gKRf{m}kQ8V@mP@^^B0^O=0hFEw142gXxvSbX8e6sZ11cY<(QLZ)rcf#t}+Y z##-LN24+hrP2yVQY|Gkq+SaWpZ)+j8G9)m|*~;P#4QCq_r4N)YmleMnGlqES%^vO< zjXn@HusQ8ov3tz;p$(ZaTs7(FN=n{0Y8ERY-yW_k^+eJ?R*=~Q9A}`j8M2o~#27r_ zRuHYu70ton%!%mKZ=$oX(X(2)y4!4K?vn+J5Y z8s$b+0`7lzIJgV{;cygp7KZDL|#Uxc`^JO!Y zjVPZBP1e(MJ-~KOE<_CJr6vq=bWSeI(Fv5ay?CK*Wo#LsZgObe^3cxTjxEZ;U0?0t ze>y_@R{Z!cOM=19SrW2Maod{3bPE4C#-uTZv2x2Hg*Nj;wCw2@goua>BH>d>ssiQh zc{NzRmHRL=JSJ9J-rLdDoz+GiagELui8`LQUOzN5$_WI$_RHI=1)Lsr+UXnLCd6f- z5;>~HKm>mY;lZWuk{$1$F)~U2U80SE8v2AeWI}v5`rqP?FP%32eKXd3U8H}TP|3>2 zAlP(`Y!Uxuu6yk?Y#dA&If8#!A0*i0qQM$SU z2fq`iH31Gw5~kGQhrWsnk@@%>3JS-`pw%=i0*ermB5QO4Ya91pkz`^;#GD>0g_f4Z z7h&1p@oP3mx1R%e-14+IHvUrGzX8#})oc&p)cx~X6m@bESOC+I@e+5P3Nw?g*-hn2 znU`r>6`q#v@(1EvB($GH9or)DYul(%e}n)>D&;l{k;)Y@j~n>W4{eM=Bw zJ)h3^cATi2Mu`HLU(_u5^5}t?G1`Bn~K_*W}bXc_M0TnRP8#;QTBM6ev&1f{go9+LzL_Q&ty05>k z*AzAr6SMJpiYc4I{*~c4(q>`oSSXF{fax3W{V)HeGud?=xM*w(t*Ui>EHg7+pG1cI z94ngwnb-I_9zLCt%>}pTiZpq>4g(`v%-7D-;XJgYpN5~$MDElfZ6by-hB0q^QoLa9 zag0gX>Q*oRDbD7s)7Uaqa8Xkmh8Z01fyChtpB8N-XOHOTg2WIwwSM;=XW2Bwq})W6 z37l}XH zEou3DpjRc(lnIi`U-P{G6gs#y_N*#4zx(TnQ~2(VctwScabwfq@Yx4G^ZeNvt6bOW zXl-ZfI>;jpUw^VnWaP4AcUy;v{$}^d2vm{JT;;;xntvDB{?<0S(pnX3ISXK0ONZpH zFH);&6`>ID1TRI-4tUZRI-d0UDd($QHLjR!3n3yFsX;=lkF8?VVQQ~R!{*hzwPzU% zTmi$^n(waXmP5W1vXwen>~-zhX12Mt+)U!+YuzYHtH1#F?k5*Jghx8%$_{eg6t?OK zWG2q^*fKI~I}1l%J2oChw!xhENEvVCQRTQCKD*92+hN7JBU7RR-_I;1=bU9Nr?~jO z;A7TE_B=YCQJN0!YbRstw%sX|P37hBwYl=#tVFf|Ypz`JZz(@g+SoDUL`->k@i&XW zbqa`6vspO=KhE6x!Q-|w<-2&Hq52ZeQgdbd@z;2g2nkY}iJ7&*Me*|D2Z)YOo}Zq% zX|!o$ryr0vT>*w1!HzB2zN#?Zgy{N?TnHCiYrh^y8vf+|7tCdQ6cDURx6c!T78Yy;k^Z#~^ zS4daD%Z*R;g;Q2)|2oLh;pD3DqM}S+H`Gz<$M@$=amTaeRdU#z{h&gweU2@~?dN$P z-t{fdVmDzkDbCi{yUI<{py1$+YvNQ?3z|brR5zrkb5&2iMDs9N`!)%JmEP z-6{3Po9n0!DLgMA{dNDU%%87(|0SL3(oC^KZ~sU8e|&e*`olf+L3I}bJv@&Jjj8(~EER`xH2E0!sn6WrUk zZJPV>v?AR*p`78A@Gb3)!gim>*`H?7332B_zFGw#Zp?-+?5Y_Wx&ythOda&oC+E)b zgGMaoZz#9qR~$-#CwPFr}4!w_~b7#I)IcWWSpy;F5p z0^?62MIY{IK*;flepKT%(l$6evRwX%G_EDN0F`Te@=1W|*!X5C8NbO+V zH~_b*@Y>odH{ETm*2HYenDXDSYFo^>RK|U9%Jo5O#R9iQK8ljYE@|*tsY2~kXB?KE z{##-y$flv8*|-Kl1)SNXZ(Su&OKVh`4N035Ph@V7(c?IQgW0>TaicxtK2~Fl%*@@N zkGm~Vg0t#BXHb$2UBw?O_n2#b-Pz>AkQau5dy@3ltp!3Qr@4a$a$V&YPSw zmt9_rR(c*Hjo7X5^>`@**!8AwC73$Ba5p6L{q+we`y4iUxJ-lL!5|jafpuJ>;S~V; zZKrQ!g+!cIDsHP*P0{%okEgEw6Y?He5M_Jzxn~@26uL!f?7$h_t;%a1Qg)Kl$6OdI zPrs)>zZ~){Ci}7V3-MJj%Nmr;C}7&3EN@30T-&keGjI&|+DIIa zZ<-xfA$+TI{tU=bh&N>N+o0_$K4#G8*ej{ zO__XA8WOp`|3G=~8C6cUJoo~RElN73#MxHc7;J0qCQ+Gmb`(UFT)T?6j^2YtS`)?2 zQGe&2K0c~-WyxxDR2+5Wxyp^7ha+?GXJ6;hp8@pjqbz1;7r=I*AF#yPD28*zre+Eu zg&vmHEL^=qjfo~CWr*n}`xWwHza~I~eD^VIdUKr1XtpMzY!1eju^5=wvlIC_X;kBu z6czY19ER|Fmf$gI50nsn`qXpH{$zSZ>)oND2s+W)c!e|?^km`$Fd{BQB;o7~z^ctYe5ZvzUx)6ifrfNARmjteb@C?MKN`E>wiHHkH|)5{~dk)xH=tm_9|R?Dtt=SI;0> zperzX27zLD0gn%GzqN&D?MRMBSq}f=HA`8jK;9$BNTeQ;V!tjQp_8qYP@+HZj^jDK zAQX-kkQlILi&gRaqUu*`9~gVk0~WrGdhH_NEyip0x_(s6OuUV8r9PcYjc zz+Xy6$%&W4zP8SSW-3|jR0%B`DFJUhm49fdoGLS(CVVdsLzf6jUTx}YR`P7P%VpSp zvIK2SWwzGQ3+W!+f)fVO$FDW(7Y6<=d=rak{Tr8Y`YGSoD4j^B3CIUkIHR^8@dvbL zzZXS&usr9h<^L882)?;I@*k(gum5pYO~xDMX}qUOklm|0(5Pc`)Xqg&Bmw9!pU%6S zIB=MS@MR8MY->@MHKR-jsZd~x)=Qvvbv)cUGJllYoLsFb z`w*U6GTU2I<}uN=3ZGXENnBW}E`6kgC)8F;-n4iWBk3T#tk$LjfWx7!|E1pH(NMry ziAc-DR8|zaX+}dJJzs(M(_(#Pm0O=oX+Z@z-Kn@cH9ynV9LY>txD8yb3s5=4VqPNI z6#>X4s$N}`@)R5db#IxD8@I4J*VZ4fdTu^Lm9ImT-tz29WaBo`_uB@g%>%B9xfr42G&T`jBDFGlM_tT$xWDUQ(VI_WnBm@U7$woCFS$GeKia=UM$w2ggnd)YfQAEq}39Zr^6 z^hV(H&R8BQ+4RP>p>b<2vmfea#J@a~GZt3v>GlVO>c1b<4IoumR z?@cS0DyMyIH6)rziGHp@{NS4U z-8SG{5xVNVvy({o>b=GkoJCTv$rZn{-F!lPI^ngWb1>BdoIW3^JLk`rAUwGNU)^01 zh0ds>9xgcsFZhhZ9$>Xsw$_<64Nr#(|}USt0# za7sw|)M}OJXgJ#T9b}A&cYU7I1j?Dq?I*rZ)Ei{s4`j z;hB}K1>D+P|9B76Vx{*qwbL}mS(Wt8K2Fubl!QsyezA(#+P2eOZQEWbSCw|oC%(S$ zqP!s$AOdz2t049nb%3Wxcpee5TO*G_5eOG)wTD~b9~E`mf{xds6x|CB_iAjsihc;U z`6|%(yf*I-DF?_Kr>*ijZ}gU{GQsGtuheudw+u{yQdr!*D`|@kduhxJFK<`X?QRXX zvbbU1F8q|}-Im-INYgng~2GQIVd@%y$#vJ`(;UE9Jh zg}4lZ;yv!jY;~uCCZ(!wvT;tyx14;fiDRO?zY=xs#O)ddv&QWBw2lClkITd2Rl3kG zDe`exe2*2Ytga^^#NNft{B@Ylf4JXpC5Mqn)nL+Z>Z?43m3w8Yu$^k!qf1-vu`rE^#lcn!Suxin ztJV4v1eQB(rX5+z{J0tUS=W#l&wE|0#N}r+w(i4VCU0v~-GZPtxATVi0Nb1$V}?76 z!m>Ba^-=h@u9|CdNoU|KxS=P$VS_?4Gfjnb%XX>yRy5v)fyq(Dwqq(7HP~@7isWX) zIjMZx&ak=R2{F)l5S3dc+jP58a3secCR}nlS5r9sbme;6j_ypy#8U}c4&A9FGD(vz zF))Zsf2G;SQ}5XBeBYrA88aor8uQ`TNTFInYF6Q6sO%GayBoVoU=y^$E= z0)DaDiAU!=ugVP)37$Cdd#73KDBOotx)`mMdIy-5p`oT6jc((b6l)$uptX~IF@>bS z#C84>nj9N|G!7Tv!zD_8|81A}1wM~b5AzQiV>rps znu<>?LM@N?oa=uw%&^j}7khOzVhll6*mB6$YT&cdt90K(PHP*}kwk%JZw?a;jml=d znXQINLLONJ^GJnK@7@%npMn@A)VcQTOIYIudzl8qUXsjDK?J3C&Nc}MH!gxp`i4|u zl{81t#htN40zKc#rOE}#DK8g_JI2KVVGvgqCzb^z0hGzO;VMtBJmf+?i|li9wnod# zfh9=ZZMN=Lx7Vu5cv~W;+|?r>peO4hb4r|43AwCRUAIpLKvi*=aJBXBuQ39uM-m!) zRFU$rKf$jtzm)reUmsiiW8jv` zorv35`OW30lFiD4s}9)=f9D8h_J||po!Ym3F|H0#S8r8EhjvGm#kUvF^6M@VOBG7> z9IKf?EmdkYz)Uuw&@RBuc2-He?k)@s0$WBSOoGl2iMDgl!fdjNWtjS`XJ~VVvsAnNU;i!1J^Rd>x7GqW zyOp9eN^$%0t&iM5aFk2I-kyHb`}nY=+OATj!<=H^-pwAB`Rtz9NReS&lxG+Ucb-2B z1vQI^rc|XNTau?#tRT^5psJI|8mQ7qYFW@CXesU!k5`YG1(l{?gglqE!zcJ^m*v*1T*`4>8?P zGsy-vu6M&>=2ign%!;GKbETBB%vA1ax=(86+ZI2^Uo{mPGKDmLmrBvjw1F@kFheNz z)7+746%aiy%JG$8$(f%;^F;YtiCPq<%8N>#xo_M`B0%I6)uF-JMumaLsPk@3saWXf z(NJ%S(ju8I8 z=Vhi(`;q@;7`_u#$neLvja{ct~>->G%Z zS!b`c*V@ms_9nI_Z4En0_D{0Vwb@RE>#a(;%EOvaEHj##(hBlO?{$VDViqyp(~hNI zHS+Q~0nUnkSx?4V3uhZzb>VAmy(8_9#6#1w`VSvdP&umB>YSr2p{nC*xxA?&d!(tk z4tE~g4WImpJmxD)mzQrNi=q^Kw1v#@>6O`jrZ&4iFEco#YT#+AGyFb-QDb)>*N09t zu){$#KEFeNx-st)%*>(6Ewe=u3FQaT#u*`KAVX5huDN2@=0+PEyHC9E290le84&vL z+!@;9nvnmR!Z_P;LP{Jxt}*-!{>6z3yz2Qo+X+GnuL!U(4&sR4ng?}cIxTO4TG|lO zDQ*AwxIC$;u~_SI!N2`uvgy?r28oRECpaewV6Ir3`yM`51l2|5!t3frdA;eM{`vKA zM<2~|iFpRon-qF8v<#JbD|G5ZKaxKil>ot~viO5yqJcQ9g8aNs;$B^LXsZ6y>5ULB zs#V+36-MF8wlLqzQ?C-SQ|yz>41vHr_X&7dJl9Rb-K#EWelDQdAymN z9-BlVlOYxHk05sD!?n>VUbP#B&^dE%MyVHc-|3%K!Fk3RXZ3^5z*H}b-o}TcSy?&z z5@8eE6K!!8-_q$tsOxAM2_Y^Yk zrR7eyA~@1>9aL=wYz{XUkD3wqM>dXaHe&WwJjk)Hx-D&;osZk)o&>I*rl=SP`1=SV z_~J^2>oi6=U!;)q#WSwY>pX&Gk4$K2b&XekpA(Jo$#hP~%LRdHzK~Z;*FeT0hqUIS zAKoVw+bnG5c8kJxj|@WFqH&r8Z_k3yxA1*^g?u)=^Nja8gE#7>ni^j#r(kkv+{R12 zLRa^D>h@~uJA(8Z`S4{+57i019)`Ik!CeUcYy9`Yt^ii>bg!p1BXELj@&~-{MM3jN|6enm;Vf&eo&D^(!mf)Xt=Iyv#PCyi@AI!nUJ7vcF z9Z?qTgaL1{))&7a7(fv-=U;C`3MQ@XpPw*No|3pRiYMav^^MCEXcNmKMy76FFu1rn zsKLwFg!O1*xI)<%<~sf}?`YDjAyH&%e6b%NOhZP2nRy8RBw-!imVlK#nF*Ygn*P0z z9!S_RBE2?t;DR1wcC^~R-<+p}CK(Z{gY*4lVZKGRTwFXu0P*vO81V)OJS{kwX}((h z$#^JT*A(yi?AzKP>gbz|z}?Y*e1djGi?tA0Vsq2uGEM6rsUqg-FNv-4D(sGqW!67r%#&lo`)%o%UV>W*A<*xxx=2}iyhy<>U)4n@q8%x$o1 zD+#C^0wjTHLTWD(%J+UQHP>-ja*?a)?sell&u=jM;gI%$8I#ZUT(=L{(vzgslM8;G+P)DX}#QN%2_ zQ;|DB1EA%HZ}K#+*IwQvvZ%666n%KJ_0*Vqy;w;fWbwOU@!56`!A35zob22W&yE7* zDm+NU%MIh_JgBf;Fv|bk&Gz+*)js^(of)0O&;s55U@trj1C&adGl{A|~zu*R2u! zAKCf8Phz1|l$4Yq6w=HVcK|JeZ{w}cLhm?u#cY>xtX1TOPZU z-oXhArK+;GkbfZPpU00?YY09ade?&1Pq`9QG>*bBm7GEb%3h=qnVRv?A@@vnmeFxk zyhFcnaCR@*T&M1B^$9W$3s!2Ow85xRKWLG&kQJ$)?S{Ia7c4F^{p5gr-_~B!q#hUNI=vbd8c3TK zM#XQSnkDu)-few|C}KAOQK1of+nBueKr{z8&@neXG4nPRvs}P=qPj(R|14p#Odz*FtH--={E2#VEZq`VO*zhL%PsiJpjSBwoAlyJibq=9mWY)vaOP}(1WS=ajA*;FV`$FL$J0|49e1__ zHE4{j?KqkcHS{F`LFa685i@7wap-j2P+7m>uOR(?gWdAa`eBv2cs5t}!BeHZ<%@6P z=)b(R)RV&_!NIwXu6`tSK*B&SDQGHdXVA)*{i8v6qep|Myz<(H446aGe$+yWyhSQq zpSf>1Qe%aqn3$MRr{8HK&uo>_QkI{zT8rO7B-n2(_1)LCq;khPHFN~^|5R=5_D%gP zBPZ^_1_VF14S^LE&FpPy0`>n*G>WU8Wy-6Z$!vNK0;3hG<*Di-(2*ppHoHQ|a|z)h zmL2s}Z#UrgHl(dj1k5L{H>~iz7<)TfTDtUzKhLenM%V*U5arXJQoDld!i64P%rzYGo7C5PkWTwExhE=rZskbeoJdf z9e`l>iAyt~9tE#khHt8LbcxM(l}`1ja?aQU;#=%1)cZ6(wyQNYdr-v~A_2=n@dk@q z0(jrgmtr4w1c^xE-&o-CV+lQ;-7koCTvUzvY;R9Z3lKwcvHmKW`dzKJJ7W9Rk_@Co zJUY@(FZmCYJZq!BI%`M|MvqT9)YFebPb3dS(iXg)v2_`$g8y9+;;FaP|Gl_LMSNti z2i&#yG;t*|E%Svfx^{tjo9Y(Mg%f)B>US50utdRF0E7&*8|mu)Q+kH)lMrt?Q;Zpi z#f_;UoLG5>O|`CP3zjr2I!a)?bTdUDeC zrze0$Fwwn&j2h#S66~qnm>ce9?VYx4yW0E18*2F|aeh9j#8u0<*qds8Co1b8X+_w@ zJE93!i0_CvrPqFmP2QP7P{h_eP}cg%Cj17oy{7g@QCy5{H~6o63Nm>Bv*cT-eq&gC zBhfPWE4o+GjCsp{HBGPh1<&`&>ZUoU&+2@%llNyGtKucM$P%C^cR_!g~DYz_J7BdEGo$XR8u z=DYH}Oc$a_csQtx1z0BhXUYSdUAGCO%MB2&KisBek)^;ax;HsKx#$axQ@sC4-Rkex zlEY{3g|LeY#EGaLeh!6GxPA&*DdYk^N&7zlwwy>UsPgPTUNZ3S;3xrb=Z!Z8+$gZg z|6gOJ|MtfJ-;<}9i7xA^3Fo?;oSe!^{;SsYMN2k(Kngk)7MHWKvO-Hs3oI(cd>0_& z$a&CZ%zGkly6^lRtmkHHWsk>FI|6|){AM1|nZ&}Tw%E^OSUyi~p73Mnl8QC6ojM)P zP*eAWTjo|o7xgXz`K-Swsdy{0nQX!|%ds1f6PAaeu`W$c9{lHZ3kidGn8HdLudxyA z)kg~K!Nuu;xX14Ni)pG8g_DnDn)DjInSms5m$JaPBJ4~E#dAg?Cix_Ig$Xux88NZ7ksb+ zwA=Lvv%H4?QOd#}EC#(SD|jSMALk?4CJ4tkbTnPgdj(fKA= z!di~J>pugOi_{~D&GY%mF}9j`!<_;~;_)`Cb2&A?-Nic+nev3}(7?o@;NGmLsSFYl z61YR`O%wVGs=e>mb~!KW6WOWwYoX%Uu8n}=_Fzx_^*ZN$4UKB$t*{t6@*nkO2!&Ea zJ(J6_XkwFTvMQwx6+2ir2MvDzkh&d?Pl0DUvolOXnEpSr`Q&S zsF-LNslKTm*~ox=xz3+b2F^P)`1$4fxh2@6W*!lR<(VweAD&SzLC&y6m*|IVPofKbem;Mj#Nod+c1 z)}zxUwkdtuan`mN5zN-D#KSJMF`agvJwJ7Jt}^1~Ry_E(nqb%R{Ko`ThYM5dBnIxw zPD)C07%t%leP3&fr}6dm#Zr`dsJXj8*^WDJe!GGHx@zKt@fDa%^_M3RJ=1Rs#>*qs zX!zE5ex*$GTLLK7%;H4068mXsvHV2urF83-xDV$n|J8vMV+k>TErF;Ad z6x0G_td9fze4rSgWS11>xcDl(7JQftwk$l})GF*GKm0)PR)Vs+1tQfkNqtJl2wjZ0 z6D8bE^l`^b#(P?P4uk3(qLZ1^G#O)%ap`Ik?jSO!hmN*w83ONX_lP9hA!aNmL}6co zA*A^di+3VND=UFtf}b7gjX5I3TguPO&AnRbrO!@RFNQCa4eDeF_z?Gg`0!yIW=TV! zrJ0$L=C4uRYA$n}QYCX1&`ggW-{hZG7hGBCvvVwPUPqa*2|Q0|NNhVr zbq6|O9LFFwUeyOmhp_;IDK$Xc7bV@uI?$5gAMADP;6;w$q=+mVC9;r zAbH`Az&9t+|DvnWYP~T?uIL`%{odfQu9GTtM^jjbo;tf86*uYKOjZ7L9)E^t6P{H< zA}aFatRj0{LI?4H6NRe@or3JGb&;CW=JN+Hoq3Fe0?bR4D?h2SVbIqk(_p|}8YK(; z;v_K_N5<3OZeh_mnL?2%x!{0cBeXR{(o5tAvJvFp+B13>QM6EG(L%qY9RRA)ozKsz zzq0)p_+6Awg{vUu!mOR)+1b0Eo}SH$?V8c%0*}E$C2nqR?ObWo8hhdwq}YS?;ZpeR zj8F#gr=L>0TjdLM*oN+Cm6yS96KG`{bF%@se>o|XI^Lb23RDSDe*HehL7UW$SToR+ zJRb|Hs=_i(H%w#T6s7jx`zX37JzWeJ1qp6ye(XLfv)dW|5$mx%h@e1>*(=xBx7t(q zZ7-813v*Zoyq#+wTKV-QWow3>_>r_KXt4;2LY22=K_KyFdGK(P;6Cb7k9z{8=h%!S zM>2;WR#($&h8{L%2s>NCbx%P4yuSO73T74Zp9?*?1IeBd7BiT3Cy>E(goIbe%eY4) zy#9K-^YgXuluHJfBN!LWg107LrKuMi@ObbZY)#eQSp2=2Ez78u(!2GVQPvV~c?AKf zyK3U@W1EujlJ~%(9jC_?W{+>&;G^-jYwGI?E5Nsa8YXcv)JZE&(Drfc^fOM=Q0x9Y1Ig4sA9YDJTDaw zZlVR(r{Lekjc$m)VZ{ZH`!EGyDv|o0RF6f-t5mtjp(BnA;vNXi$A%TDzhETUdADyW zqMG^>nhWScj%d3O^B0%YVg|%c8f}nW5UKS z`=K~DLCeL4G6z^FmMJ(rm91;ek*==XIc)g9!ycWJ`^j`4LB&Rwd3qJ2;=x0fG=M&^ zjIkC!PEP%Uh9rPJoQq0ek9-*1=i}jF#Ir!41{@0$w5l=n+bOwvppf!l`@o+ASPU8m OM@>mf@teF=#J>PSpdu0g literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-edit-remove-file-rule.png b/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-edit-remove-file-rule.png new file mode 100644 index 0000000000000000000000000000000000000000..74cf1a5f45a32b658a2301c6bc313636ff5bfea2 GIT binary patch literal 46086 zcmd42W0WON^etF+m(k^}>N2}*cG*%je3qh3y z8yPFkIdS&cJ2F&8O85s177P#&&<{}&0XZNb5ECFEU^^&~?<-SewO-#}!1i*&{6JMx zI49pHV8(osd_X|8(Xj8j;NR!aHX^F_KtRY2|31K*M))p3K=tXO0(=TCTIZSI8fcOj z!ADLrKL~UEazeuLR8~Uga(@w!{mRpEc7_ZIQwbphVRrKMUFjl$U>140cs07B3Hi}= z>qT*Qd}U|kWM+J|@s$->Pn0SFfd~Z#;>)`LPk)2q%liuvN`RWTFZ90#?*DE)XW2B> zwufTZA^5iZ&rP65>3yx9-k0tC56!JW*HSSqkcKbuq2T{@#;DUpp24tW8)lsnK#KyB zG(k;xClvwb7nRFR<>)}^8Od{8_6phe&~Cg59?TKPKXGqvZUTsp>i3(U zlWeRk0OyK#1pEwvXh1Pp@`oTZ2`V7GqxtT3i^v+BE@Y4>eqj^FfeMa$PDN`fj~JZp zj|nwqlRVX8ulJXW&Dz}&mg?HqArlmKU*t2E^9ueVo}lzBR|nAoHm&GYl21JNz^ zZr-g%?Oq?RrgVVdY4e~|n<^>b`R*lK+@!aM4W`m9OCls(1Oz-{a(O1D|?CgoD$mHnz zw!Tk{kTv7pTKcm-R1nco&6Z?Zr2CdedND_)#EQ!OCd)8a+3p~#gnVx>bnod_dy92= z-ZEdDT7=ytkCErfG_}G%a5Q{;xTixXMr)OxTrnr(rU;xO=RoW|2Z}>0Eog^RpxtWilyo z5vqZ)ofw;Qcq++S#b0PqYBklK)2(%|zM^fWdw*&1GKvjXUomjTV8LE)QrDWRaFh>RTUKzRo?4+iXtK- zLjy8s?Y*$X#mD!Cqj|hP*9Qj!M_!S%Z&<%vA&P$Bm5-o4q-7iEyY<&P4%9mj5aJNa z&z}!R<8x7-S(sD0zMa4HXDm@C6!?hc17U_Pl-V!$YDHb)bB}kpHFpQQFKc!FNYMj= zxx7nXeLB88oc&TejdzMnWs`|eczCICT+lJ|Dax4M4`Uuh%uRr;? zj_gC+mi%YOYLGD1Y;I4e>KbEdlP?O_x60=*n<=duoBlvWemYmcaSbV(<>8?F9a#3I zfoP-x(e$R+vCJV^-@C9!9J~S_Cr~V$jL5Y-S*++dC1p-1A0cokFBA`*fnMxN$=~!N zQ`37Af74&(0ewZFZN@&!rMMh*Wz&^$A-;;7t%a*?j;^Hz$(F-W%o`sX?!a`)gh-%t z!jlVFdRMq>0puj|e>!7qLB`J9Fh#xYmH zt?~N|7LmIWrh1hAa;tG`kM%TaNOs>o42S#i=fyrB_893Rj5#Ohe00!NBIqx zYn@FKGKLEFC1t+CIXRk^jc$vCww9|xEcwe1m5DLw-7r*fo6qOUIu0$f05ebCyU#e3N8xqeW#&-ceo23w#6e0?~$Xv6Q)mHaOIr*KD6*> z(G!24g#1dvnK`3p>0eg-y{2Wq$ny1${!rf&6&jrT@Kd0N5b+Z3hUeIf5GA6mNBy;k z9wgTM9)6Pm7+EC1M|gOS2A3;it+JXp2a{WByyj0qN%-AMm=W(Y{m!*uSyvUh;wHOA z&bj7V;dp7WwD#dohXv3~h(~tBX3~eJK)6<9_NasphH;3(I!L#zpGROa#<{ zD_Sjyt@62zkol8w0)L@)dA*@|JMd86{kUq2f;q)tVG}3FP zBH8)wyR;dc?@^Ey77VTZ;y+M%N84}v4icHverycZ}swTD@7P81$dj> z?k&A+V5w9M@nQA*U;z#fx52f}I*q5@PNJJNDs=3hKM|q->*|x~7>o43-yMOV|9{drY98&r=r$qM{iq$*?%d_|QwW?KpTU%wsY0#3hng$ilG~e%uPtMel6OvPP z86|C?PYnq6OQAa^_*TnyM1Id2aaG%|a*w3%pDhHaO=9{)3xRS7(?1gesd6gH;Bz*y?pQu_pY=WS6W>~oD%Y+h*` zSfYGojeOu(;I0Nleot|T+Ki6$BFy-KH{83P1<*>uSTOU^Y@#fmFN1MaJnhSfZwPsD z_MOe!K-+3>Z?CzO7NjeNaK&1*F~5|6G~0WPpNI}>77Zxn@8KP2fZ&^6zxx6wEzBDh z+Z+%5=jG-IopU%4SsR1d0Wi>QQPg#M`wo^C#H0IRB3Q!uhaFOZ5v=oV=mZv&*uFRF z!$(F#&uVyeuBN@96U}Y6Iz%*qnM)5Ff|1S{4@aro#)Xv{1yt+~?AgCY%+pfxZ_%I9F|YJ!T*Pl4A~KWZeyoYB~&^ z^;FiP3D0Dw3MY%>aJe_jR}vF|`D3X1g+F#77|$!?Tn0=UI8}PCY|>P_She zEOFKI=A)@qndECtdP)W6)}R-flO5Wl`+4ing!j9HylJ%-c^{@P@`cmc0#qL-rJq*msa+w>MYymgu`mDhiEXPTu8KuHQ@W#te7~0@( zll;JwlbRBS+`IbwKVBbdHZ~ov@ESCgov)UJJY=)DSwe6n&^d(LvmJ9+GcAiTAQc>Lde z*MIfOFOweU#W5mcy@NgFt?o@m7*u>nUPB)ZCW6N(tL8arAoffV(4HLMgmKKj{G=$R zY~spO9Ss&pjEA)18cnwhivfR>vfINoji@}IcSb1Ww>Eeskz`DO41jVD$(K2y@b4^h zStvmzg4RI@kum?&n3sdqNn?=nDzkl1QhNX=PI zIFTX=wZD|IS>rou*EgQ`{5MpAtA!mZ@cJ9=i~H z#pKN&2PlB&1pK7}Wu(y6@f?X&#KbRc6(RXBg2nfx9MR&jH`>*#q9l#mZA%?V1R=;) z5qBZu{S_EUhm^D>E+AuL0RxmY^L+h0hKOAl!}m%)=wkXkvnI!kD$(+OTQ~x|^|%!v zYj3;GmmSz01fEN~qdxMLk~0Ybw5bm|=~sVU8{cO0i?3YZBUAI&9?fSrtZY$})KPTR z?uxRcVQvHp?-KS2bQyr7VFzTICnABbx9(AC$UM9#6JbphG33p`m-xrk8h#B~D~h2f ziy=hW0&Wo+s3jBkoQU~VeB9AK53kYsF-BWmQ8!f!!I^AN@9qEx(6J{Az_T(+2% zc5ye4gJVR5>ncLzJ(^U;x1m-(7`B|-tLCBmoei0O$gzgUi@0IO#Usb>4QI6|iWzwM z7j~{~kW5_VmQX zG4Czj>wZC)be_)D*Y({nji?4&{D4Z$EiV>aX$;QIEtEw|{}P77VX?EnXgU-wVGljJlJ!-f> zuh5F>M#Ytso?7#=tx%=3j7K-WwL|^I%;q|kCJZxs%7YEey2n19)~;=YxBC-x zXXQq~c9if;sph98L|{;9%*a&_hvAEhTEnf+Abe#~v^+QUS^3a(6^y9?+#;mY<+JV{giW1y3_>!|HnH1M@ohzIsySFG=? zI?0gaFxccar8nvnmVNqY37tsBkEtfgY{Th$I1%>Dotesh($4X!c@ZO(tBau?S@p3@ zHrDvmxuNO#{d~U{I9$i68@gQe^;ZX9$KtDwf~^onJ(HUD#uq<(L7!PWYR%~m3=Vcike{<4`<0VCf)=VHEZx+Mk9&X1%av^wG3FKRUGT9z z@G2KQq2JrR0~RlF5ZP>@l*;{ibdJq#qyTHWuRlH(uyan&l=lEpyuZp!L;7AAmCZCR z03ich8YIHQlN%=|6pLm>)_l;o$VC{Enaomv06`}BQ+rcGsBcsJ++w@95lKHhI zH2;B45}l3s_IglMIi7N`2#LpZl(Y_zUn)V*t77i=EcgEq-7pQ0K(lShpdR| zZAG9W4?0bz;HO%?`Rygc(Q9i3CHpNQo%LH{l}h8IdI31B$lTnh&NmHNdFlMu|C=M7 zm~Ii;Et?ba{SFUUNvsYVyA@1Nq7G$O{FD|D5$B4MzHd7wLyOI6i1?lTyQ}NsI?(>8 zJ7F|PA#=V=R)UE5b|0SP*TKP2k>oOR4 zb@u2MB1!)y%wui46c!tr#)S5PxF`+~A=kvxx%#{b&?DXqML{C6g){}Re&1+PHc}!K zPt%NVUKX{xa)WV%?G^a#?N5(fM3^WUkZa)NM6`I3x-qQkM>sZ*r|p$X2%=m4TJE=x zbYoNttb$wR%24oUmyv?By?w2A>7ij-Yh>X8486eG#rK^UAm}Up;RN@<0*qR6y^jHc z%1zKn9M{pLD%mgx%&ti8f+_L#ClRm1W+CnDX=*x=wc)Flf{KXW-mwyQd9?1yEX3&K zJJ~IU97a-B@KrX zOT3$b3TJyTYwEUah5U4%YpkY@=C?#c-^+oG*-a&{9?MuazuEnZgC{d*2aJJz$zn(1 zT>_3V=q!00HyuQ*3S0ppd7#Q!ns)c8HOF_}Kircl+?laGWLrzytm5PAhkWAkXbn;K zz3}OC`Yz*&`l0Zv!9$z-``u|Cp;PJ2j_<^5Wn>_+!-3tanehPc7TG>NG)?{GPg=mf znKydYf<#ubrc;3PnoM({rsJ91KyQV2mA{bDnH7GXSn0iEyXhrCd#WrXpYyJ~xL-XJikfa4BSsCqh<_eq*t|8|o4 z2(Xn@rk5DligRJLk;s!>mDXQA`^yBcL3gJiFf^VTcydWdREu&4M0JQ(?v&TVJ8n9h z$7*S(Caja*^i90u8*udS5^e|>47d=!n3FLxUc04CE)BK}+e1nc{KWEq3UK}2RzSNiqq@x7cIoPJz-dM^= z0`yRiHG?^V%>{eQ6N8^nm&wf_H;+0l zGBugbqD!LD=Kf@*xLDocBqAs;%_k`?F3Be?4^A=)7r1_hJvt*u9IH^_SJLJNF3c~o zU_^bO${}U+lTvSK!avoF!fYSGIOW!(E{<5355e@m+4iFBDi%*mOJiqeudS_}*=uNO zVrF6*yvv>K@^nvW_5SkG)YMdgn;w>(UC`7o4i&`@Eii2sQWgjGK}fP>Op92JwAg2F%a%p#3P!wH3gGO9~GtPJLk*CWQStg}4(Bd)0GYx18W8M5Vb z1#K)SI9R4wj>qlMVlta&yElZ?YNvy2)F()(Too`FqQPbu*cvZ|syFxDT~Ka3D;UqHOeGRhNePtkQ*wE`5eA%k+Ia3O*#-k}O(da*j9B;YY`+j+1^ zTPs=08d8j5-<}OMVBLd2LvZ`z5h}n>1myB?swkNn5UvAEC>!WQimqc_HyjfNwmW8* zvoKvgt1g$%S6>w9kde}$^Kw5{hfF8E8KnT$a*J+&oLT@z_L#nY#3`Du=%Vs`-CHRE zK_e?~q$~c<8GWC*N&uZK;Nakdu^}QJKY*+4a=sFLjbK2IrNh8sj6jQ@5y)sM!@V`T zxLaNT&4s~N`_YXtBN1hHYg^Zh4ohiHp$RN4M#=-HnCxdbKffAntNz8A+O8ZB{^Zelh}XlP9DyTN~S#jIdNO9cUj9 zhOoAhBp_O`n38CnhQzMi#o2YaYWyl>pjlLVE`K=AVZDp9T7TFz*%rHaTgJz=N0#tr zxt0>vg%ia5E_A zjMz>|RVj<-h|1~I?PPZX9!LHjptrZTySu*$3JT+SD?rTmDHk_odWTX2>qt~brC)BW zcd)hP9Sbo7K?4pH3sh-ns>YQCi8McAJjr)vZUme$ia#)AzR290E((EG%N~Rusj&|^ zQR9t8#0*M;mkS<{+FM<)#8^VtEbq%4v6<0fr`_SNec6!AA9Y_=m-XcB6B83v9nLo_ zll6|+Iob<2hZ|b%*SMc_v+(eA!T%5hf0xl!BAgC@IsF^GXr&nyMpVki2a74+eB;f+ zsvAt^a%9?@VY^?+f66eOe-AUebvd7k~$bECW(lrZl09)aJonf*%7Ftpz%&ixvY2tcGv=6DNQtf08~@FAdhNnv z(48{-3N7NI`$9&>IbRK3qo6WKiYO~Z;2jaE2%{g|-|htkB|BQi^ZGnAP%x2mo$Kwt za2WLOvx4ZIvWWP6`|mf>MjfFM6rrJ~>kjNTS!q;t%gLM$x5AHX{I z73^ECz3#tRkVNJdBsC6NN|r9?{)KG*F+-EcDUY3zl2Aiy+aJ@cZC|gIp@JPR+tfz; z*P2VIjQB3My4sqfn9UYi95s~Cn*#C{DnIQvP{6o$`CbwD;TA;cjAVkJ(-W^2x5*bG zTno5Wf^TtR&lB{vIB&6fjwggjvY#Y^&jaYTJ!C@%0tpu=b=5c^?(c8VAPs-ClojK0 zz{=4($2LBlOujGdRZj>;&Jie8{gou*BV2@M9=duq=NzA$KhP&Z} zYT&5?ZZJMgK}q|I@DI6w9m4X>4--_(dt9!dww{7OV8}};MbsQA(a{7e85gvN$?z>6 z^~Q(Kq0|dqU*I62MN*Ixi9qwwaN&mqM{ky$nF3~@kc5Okq$&LR6n{)-bm~)(+G*vo z1ft_5U;@o6tk@``c?@fLI@?RT#0hTAx#H)Q(>gk{iDiq!m(C1KrFn$l$s%% zIef{bfzv^pRQ+0g;Y-X2|eG)(@ICQZpd@X_V3vI)d@q%ej3zr&`pm0cx*z4sv}&`yS#3n(G=vCQTz^=Ul0|Ccv*k(? z^wt@lMt@uQW|SCCu}eny(kgY%l(3k;Ofp@*`Bm7*dG3Q{-Acpbt2?eY$E zw{tb{2#vVCsmKDm+}J4&kjSN|8M{&LSy=zc&s|&(IJYcqMag!H2%!b>d1&M1=C&mc z4M0m6Gms##?oD!3XSVK8rNLe$J8F_}V&hgjsySLoh>oK4mwb+|iAvDs!)*{Fc|+{9 zG$D0VCuU9*Q0`0q%$;C_1WfR18`k85Uzd6nvg5{>J+FI^%f!KwO2ctZ^!5t%Y;%sF z_QQd=qEg8~*o)-w2W1Wp((;$f@jh@|v>+qS!Hu|qPP(rsh#e@d+)9U{9#i@U4s9D+ z&-jAWz4_#E>S!e2^?du}bRGe0F=O;w*IIwL)HIa2J|4XrZ-+%~K9-AOlqSn~r3*M& zXWSc(<(zdxx99jOWVixk<*!bf)Xj%Ib$)G&J2}%UJoYu}bGc+T+(qsEZlKetd`hR5 zXuKmjUC?l$y(IL6K2K(#L06oTY}X9VV{S1%f{9od3hj=GRlB>Ec%e6+8~v${1Eprl z!^FdVJq*gDg7GRh^C?NRYP{<*>uc6&QFAc8)S9~I$+r%)WqObA^Z)~MxmLA^UDp2~=wGwYwdYgOs&N2~$ECmEh>;8)@5}v+W!1zqcgkMl~VngnvkP zB;7rfO34FNI?9vjbHjvqk9zM0Qp5;++1yj|mXiSDWbA9|$}5kVBJbOP1LqDWr0UZH zH$wnApyH#!jW`lmFY-y~Zx_o+9!v?rX0un@D*?oR=i3St;RSMds6Y0~2l0NABTaHl z$m0z-gcw2b-(|J;BR}1r`rrA&tZ~yYeo2doipS^onoC7}O@Fy8rJ%<=zfFb1{O4{*W#y0t1YDJebe0Ok#Q${jV81q3Y@n_zm;YbN7ozJiiZHG3S zuaI{~qnn;zK2<7zPH-*FfFAAe?+O)jd=Pjifjnjlup+~e4x(VGr-{f6l=fB3fjjD| z#7b0JnAzMbSsP5ISYi3;iK-l#pqrZ*97QO9KbD+MZyPFBJYRADfVK^=5)m?Vpf*_3 z%VLif6zq*VZ(*Ku(Jw@AYVCQF)P!F8m0HKMv)hGQ(4f*1^Fo23_EuL78iQFfRA&D{ z@C8Y8=DBBNT%+C^-F^?x4;IUfl-nAxG19MtQCtkI-8J&x^6d~bfJP4Plb+la*WYAe zX5_KDcv?GyVeEvwfHs06B8CHEAe3N)aQ08JZQBdAwL>HIh#l40#ajN` zg4Fg3LT(BhJ!TRryF!<{05lZ`Df^FQOP8P0a0&{kGUnFI696U)zga!biQBPUjtx?? zsc1{)4)nknFN~wK{ z(@1BNNK{tzqrY*|puG`2;#MQe?Z`LZO^z1L&(Cx4kcJ&3SL0Fur0QE^)okC}-9;g3 zQ?H8Xsy8_N6)I2w5Rr#5uz*kx0_RA!10LZ*FFkEgQtx3vNL6uQ6%{g$!lBEMmy1w9 zxiRJ|l+*sMYYj$X}HR{9P}WiO-g1(1)FOlZvV*y1sI?} z{`@5uWU#U#LLhdM$=hrmVg{9*Kk7M^;6!r3`0fZ8Am0PYpUp8KAtvs{7ZeZ>V7uvJ z{q}t2n??D?IesmxQUL`G4GjgAx*e0T4DQKy4|lu-$p>rTO+|DO-v*yMsks$P^=5{k z4NqbA#;n?>!qsb$>ne*n{ohqU-suFtLXBIZX>lKT zk7{IO6<|7cBF=BzQL?I?%<9@rcJ~aIe=b*cj{Oj>#$O(si>X0mwXa<|YW0V)FfsY^ zD=I9WE;rE7&<5zghuM4`IV{_-7+#*m{2g;;V=#KP31Ude2{ueMf`g~GAaKNv=z>&9 zvIfYuqYsLgH$tYdQ-f$L`lK<_c)~lOBV}W7u`&}1I_O8}rO4DJbfd`J*|1#75TX)! zGOcKaa&5@>Qr@9XOOLh*aqV{qN7GOEyhP?UZhK`$z48(vEON`Kb8~V+R9Itj5w#(J{u+vpx*`U!oorbSV>Cz{&Ambf372=n{xCv(lI;08`KR4+}Grn zNB>^MO+=9bl~0witE;K4Xkmnk0P40PDn@cra&qFez%Hrk0=PU5MGL-kZP?3!D|ii| z5OFdsl5KdH*cc_ntv&1jzB<`AwHdrSMok+8aUMb&2gO$SRXglzw>k#C$ATD2F_(O= zmIVwEL9B4M(eHeF?mgI9;P@m4^%h)U740VIa^=Y1VB7RGu(uKO9^2zpsX^>F#BWR?Qlu(N?uFw%LUIXf4wyEgy^Rj6^X}!apmYIOSOytNL z=;zw{@mxG*P}ⅅ%Tfxu@tn`synJyv(!uqOhXy@G+V3N?LvSjrO;qOI8LRcPE_lI z&Q9co%i*CzY+I1n;o6ES7`qR*EE$3;|8I1nZZ^P%Dj>Oja!;g`s2k zgoDu8c|Snsa1NJFjzF6XoL{Oiu68sW_DJ{eC7f0wjUpLcznF*8r7!y$LeK-gQ|t#d z7SpX-m)+v2BxQf!$cK_<^St^@uw_YEq;XXycX>$(?>j>m6iAvr<%%vGFk=veJFq9a3R3t5V?z-Hm%yf&X|o4-BG=JSBNTwb4pjb@XnR z&Hc}*tjE7N?N9idx)Ws#Btq%Ka_ z?RtA{Xtk}Ua}00n<*$sVplqS>0Hdv38jM^Q^()!Ad(F+RZR*c1*=XXJyygwv)IgE^2iaXymi!1s%8|LCTK^GqTg3!jO6T2h zx1Xz;jSmCG&WnVfJUQ)VNFfj){~O+j{4bpI|I|3cz={+qo(~o11a>E&`p2j&F#Ncw zQiFvJe|~m>5B?p$XgvUd97+@`qC=}d(fIk==bkG=_Rz^5Vhw!Mty*t1Ha51k26kMf z_Kn^02w;j!OHb~Orb7j|;r4v4nD`_I6xe^lXO}3~YbWOf>$o1ET~5_3-fA7>+-N-Km5aP){kOnMyWIK&6MK)qgA(%T?hb2RzXmDEF?Y zz8FZ7p!Cf6BAYm7`70h!Kn2uiar@!rFE-~@Am`53{Bqa4`S&e})+yVkX<6yv8IwQ# zLYUre_?b5KUq=%zx!#{IHw$U7A1}ls;%M+V&#+v)Y4m1JJ)xmR;o%S8zaEL}zRQI# z!ODR6%8II@yo!p7yu1Ozy8W^jR^r1o_Y;O?gpK?6FVUv6yIBS~QgGs1TMA;gSUM3QUc#@KKoi-Og8x#n7-A&G-$#BU3RA z>$<9YO(-{NJc5h8z|}oHD@4RCis$ObeFJHbcr0|5O;&vZ(ZC;v8I%iiOS3y$S9;AP zmIof$G06{Dt?`7(2 zZ=khk+4L^wQ>1T?*{eK`{g3I*%)){@mdf3t3Q8IVRv=V~iGTT*Hzlwbz{=^#bo7gk z%@p2%FXQ=*nHZS3@Jynrbr`llf9Z>d1Ajmw(1&wmJ|Ax;GF0Cv7kG23>5XMC+cL#= z-zb#hPuMaHTIg@|X2g|0U1}1RnXt}@?*Tob>aXxP^y>C-as4VT)c-Y`P4*=b(FN9$4%oY#YfQ5;Ny?5!RFLvsoejHJU zS{78$L+JH0TdEZ4FTZYG;H{|hdi~kjIXJj0TC9HY<4Hl&n*d#UAg2^q9^bd{VNiZD z2;OwDjfaD}y|C<#yC6lPE~~2Q8wG3Jlpsa0!{(xHr>-eYtE^nwot2fviBe|NM3~BM z<&jbvx*D4vD8q3um|%(uldg%^N~5ZH02(;=(~LBf-~VL{#)3H<(G)%W5drn*iU^uY!f0%@G>Jqivg`9;BV=c#R;H#$gK;!TbM!F0I`P);FQN&A zWfZ@^ARDCk-C2y$w1u^pHb#n!imU5kb*ZuDDAL)JD%^2na$p8QMQL?
d^+$+@B z2)uz-?F5v{f=|00)Ds+kK9n9iv7N)Rr~%nO(pDcgy3A)utupRzUW$_{6r zr=tCtv$qg%(TVnwCk@)Qq$De!xch;#b1zXLYQ zg5rK~)5Xmx@Gwr1@;N^)*VByKb2%73%Bf0G(Wh9oJfP&a|A!jFeoS7zzEH%Kd_r=& zjx*fQC3qp)O6$Cti1ydq^@Bx_p!Hf@j6;q0@17$&0WOStPt0p%b+Cg}mtFMF-j5a9 zV$|uRzq`p8YZILI7d>Nln8aAc!s4bpFP{qEc-ffmJgy5mF!$MRx#bKO4`-|1ad^kx zokRq)j68NPV*_Ij?WY3-c3Dwe5Pa6(`FXk71@Tb0C!EWA4?&B-?b!6Q0+`kuu|YY{ z4+0LorfyGXi-8{9vQxF1l=AXn`CJIxd8wA-xizfDT0hEJL~h)}OS~En`-LVhGck)K zztg1$@qvfj%)#L7MvYqM!8(c6e&QyV|`)H zZKN0TBVm8h3%;tXQ2zcfrJyA651)Q4t6&b}M}!E-)5LoN3sA_MsN^d&#rXEmmc$H% zb0q|6BF43Oj>AZmKI&k_G0IkpOeK=n%48b#CYMKG3{M#i4M)r>tkjm87Q0ZE@?k7w z)bw2#-<&#)(X#n)P&%8PZww{@Q`!LLBP2viqgRd58Ix8hLjJS$b>Vw6v*f)-?Zf8s3?Q&eFJS?lBI*d{xvr@Pu5EK%W`)u_RlF(7@4uv>Y9r`z? z(C3DKQPo?r{GzG8jNu*I^O`6lqprhVu$!KopA@kK{)4_xGM0RUV&5vc56+!EXXl$T zJ-AiUHU!YUUK(*-ihM)^iK(Ykv=9g9apn5PTJO619@z-4eYaF-KscnrBl{X^hm0mK zlB!FG%>69H!A@EkYPQCauvznFCIkIsv;b3bdezOv@nJP)+kgZ6TBTd?K7iyyu+9UU zDewHHX@quj>9AoP!s!A!;c9siyA%DYy=7q*J!UtXB!fChd$OCWLoxcB7ObJ*aC#%` zp8fcKekp_XR@Wf=2Pz5*%Ja*v#Y80`=iest@wA5D-}|1xYoV77>*_|~qoO|JVFT$^ zM=Kqnn{|C9&mQ-P&&CodmG`~HovqjiS!|x`{cxR0@Ya$aX^zZx(?ahugr*Zl3^3pH zU<1HyMOh46F~5m}JC-ef;+rtxrt^xJ(Sd1cHV)P)HYe!A^A#joYZ(7y!FQ+OO}G{1 z_0M#h-6xz5`=jkFoYacv!%G5x+`0M}*X1W|SIQu8hCNbn_sFcDj-YEChXJfD0q8ob zfzM$W;f8FO?$v#hGB-WC0~!^EspmVf)Cl6XD1=p~oj}!cJ^oEPLn3cKLW6gwI$}nN zo?$Mz?{H{RQ1*W^dQvmOSHeb$dIm3+(-AZyJM~1~d(d(dv3@P~_n-UYm-E6jTli~Z zi+s*Ktf0TJmdypLM{x#tgG)=dw6M~y#9{3)oJUGDk<4rXrl&U+PsZF`=`g(q$*6__ z_Qw+`^VU-redXOe*qv8eg%V1PMh)d>$8_MgdEZIt!~ zY07R{K79_(*bmx2$f0fMOy!!d<^PbQTEh4-M;6yK)~O{`1`Q}b$~!p7+Bp9 z7lNiVWxI`rw5aVu7&V|No5~$4TU&)BR?IQgfwTD7wgNd+sSmV_Vn#R-h8UGSvSsx9 zg(&)a_p6ZAte10Bgx_lVilb+oy!mn2+{r&rM+#a<`gqnN(eA=T9l!-4WKI};ZyY9H zha;df6!SH}*zhtcbDN{%k`wb>tsf2c2zCmJ_EQqp%6+}~DkThCVT$eEU!QWjyDD5D4{%b}`9hII$h%tcuiM=x;5WE36>8sj zL^fQ$QHEnNL4c4hPz=px%vCQgEesiz=r}0M6b99cT$#UgY6q&&PMreHRz$+EEW$XNu~;2XavSJ6|o|Tsu&??Z3Maw!1nQgqs`EDH#?H- z$(u(pJvMf>RG##IS6J+d;k=B9X0~NY6yFC8EiElM%^}PHeP~I`PjRJNu=iWNk_0CE zvhz8ytdhKfk_Z{eke2UVF#@%9adR+Qi-dVV)p-pC6&)=Fazq}w%r*}4va8bNhgUuS zw}Q=#Ama1--MC7e;$!i`q_WeNB9p~MW>%e_qXQ#%sS=U+!iad`NF9aU&{L;->E(OmIL;i zeF;;1Bj1Wrbho&OYIT1cxR6vqo%vE37^59}84W9-JpreL|H*Nn-l;76{d^mfF!Z~q z0-ScPrB`4e(06!}b*Yv=MnDQv@&NQ_Nf;L;G+N#DoJ)W-5}#vtggpnXTXgYPN|849 z=4>RLOU_!g^z4yNuXX&loQs3=?BU=9=4*oZEwTyJnwjI5D`_U9?qeQb?AUQ5kd>SE z*gBnei@E8WzxiIqzcMzaW&~A^6pU6~Og49dDKpIJqaf!&IJ<&9Ll7;V-b6Q9V&E{V zCJIasVSj{%H1=qG3-)c(_CF=>q~-yye1O?7hfB1dtY(`E?%1&!9mxTZ0$FYR#Y$X- zcY+z}pl>hO=j`5wE_)=|?w>_;K$o|%DvZwf8=YL7sL)IV#7TZ+Z;!q^z@Nj#dU{RF1Hnz3;Ah|E3Th+$Y+BZv{ zVh*(46WjmI#^_(gG2-==%2C1GS!KoUEZXepa#Rc^MkLWtke?j!d#lH< zN~-=L=;7+6g1vBm$Xw5x!@V;30v@E=ri#?G!?ZW>-XMpW5}q$BstI;Gk00E*C*qboikgf2@gm7U%dTebfjU! zwhIOwyJOqxj&0kvZQHhO8y(xWZFFp7s-NebnQvxmt^H&FOjRXWb>qT`<1V{-#jefn zLgSpZJ@pW!Z`~(HR#h}sC>BX!X}(OQ54&^fuc7b1ilVJnI)uZWsx zH^%3Y=vL;Dku((yDN61_I2fHg3T4|mj907x5mD!U(()kEdnjYMd}Eu9o$U9>Wi1Khk&NbPZL#K57L=4d z$(2m#B^I37 za=?t{?G4L(!g)0U%r!V|Hu)+IoK|ALQDXq1B>l&D;6>-X*lM|G8p8J` zcl(g%i=Az4eq(cXyC(%ADLrH z?A`OzJ@(m^4|gg|W$zZ!MQ4Rb6P%>aMc6apmVVgh)p^_Ow0pxwVYcW+G>(~I4uB-l zgMl3wB}In1wdQaLJXy6CzarN{ORm$+)>Q3LrZ(2E>DXd;Epe9J z%Z~2N*^B!MwNrtS$>znbT z;IH^nor!Mx7kSTiL7K-=XBMt@2MRQE_Zlq8Xf}QhUruEb?>+fjS6al2Ai&)? zIRlK{g0iX_dG~?#XN9Zc=*u_u&_^o+T$lA$@x-w5y%?1#R_c z=J@Hn{;WUm&-D1-3jFa<>|BcaeVA%I)T#O}R~TK%=zlJ0#7*%*-{&I9)}0Y=e&6Px zpJCgda>2d3ObDroKJ0Ub69g==_-f1hqR8W$ieK3KLI998f3uP!G*c8z5amVl$@q+sfkAt@v)Q>7bqEM0FeKv{-QJck$ zQtt~IO;S@u0i)TrH(FjiX9>^7(JqB^AZpMc#<$o|IMV*e*{<5{{`Tw5ea4xS#TH|` z4I+u5{)f-3gAG|MEYx3fDa<-@+)WML(C_3mcLw!BBE^!nBH3MWzuiZo)57y_Iz|gM%KTHwSA^lRk4BE{ z^8XBsqaGDA7P?-oCfYeYvaK#Ya$bLn>n=`!Mo=I^3*BG9!^swltmix zMxM5!%oa#!sq%{smm11Y7_3}DpisFSq5+f8?>$2fH9Sc>W7jlC(HhZsJwaVdQ`At> zBB7Y_YhHoy(lHkQy_s|55VT}+F``}G$3aK;`w$V+4}^UwpD7C-|zAMdxnzF)l6M@)b`VnKM& zr&HPmNv)6S&`Dxo%B%#XZPQEU0CNkEP*F$pj~P@=Nu~j^6byQ=oaJl??}k3-#^HsQlc}VDkY(V z%i#G)7ui>sQFdq>A%@GlrmDL!`KP!X`Xs;Ox)qrodYfnLVrwZwNO85@CO_C3KSHg4 z5W6i6k)hD`IfZ{B1zxj@rrfk=`Wt8cL!^oLd;JP}V()X~l(ZH;r|s!@cCKc2@)b*poG`m`E5m z5sxLMQpF1QbX9Tk2>554{5_ggI*^B@pHKh`^6YSJIy!IPJE`!!e2qtMoJzzSng&yR zQvMZF(MZM7??CN076u0Sl37j7%y3eo<MG>Krg@Hu~4N74k*d`i7rxktCP{ll^fM zsm%+-sVz4Sr8pUlcR-~BL1Q|BoOcM*n$CWPjPB!kDStjD&?DhCSQV*f+VB71Y;vTx zT8_9J@Zxi~I5 z1PzB;aTu-n>=>@n$;wLdx>|!c2c8a`jFO;wspe$qepH%YUd&6}0@7|0vCc3PAC;h$ za{d8=q$$trGSCnh8Z&skZM?pr8453@iG=_OFS%AX$JPzC9BugebZ^^xMY=NItY5FJqIhI zi#2W6p|$w_#XZrhq)PMkmyzIxI>unh2f{5W>U-W;A)ZgbWWH|Jo6~hLtVk&#jXX&n zRXyp>0e;hTR-J}27eZSW(ga2bnks^v82u#uLAfhe$~BF>S4h3L8iijp2Hwpefgy4j zU6RxbI9m9`{#6Q0nB!S^wMvk1+uBfZrzYc2Hy|65v~hJ+p+K4^c2c2V=1?*S6$d!` zbIyd40vPE5cZh^aTiu^6x38K4REb5>AKE#ax;LiAOp4`!wjL%Gk%8qW9X{_F5p@N{ zo<0;Qkw2e=31eMmNs&Rk8dab{NOIn9Oe0K!2{$jwNO3YA_f>3ty+${8$d-bD@xc)( z6(u7T6$eZyVX{D?!}~}HiSDKyBZhQN*DD-O7n;=f$ZHP457ylRNdFN&Kw7YspDd9Q z1=`0DchW!CO}rC&pZ<8Hzq~lpRI2$euf^&R<4NI+Dc++E$1iqMzZxeQUc-$b>csV6 zBNI`UIsET4o4kUp_=pF%A+CgnJ&%>vW5%SG9s5=0WgI(UBX?r$3ogx}BF%9fQ5a#@ zNm!H4accK?;gle1!~_9i*cMqcU1JEMxFsCQt-lEEPOG3t>gOWu)h zZMN^EQGUQ09DtUA4mO?1advbhMgzpAuyEMy@(f2}V8H`rN(GC9`ojY)$!Yv1$oH>H z;PFcN2!M>vINn7fB=3fsA*Q1r(Ys|`m$2_I1dWip>QwR3{$kOLd%Mc@o+OwR^?7?H zqB_Cj%23c##4ni{txybzHH~gmW}I6}kJGUs@m36Yeox4;?L>DDYitYIOULw3UMTga z%BPX+7Ku4@Qra($B7a!vWz|9hl!VAY-DLmVI--xk;KZ2|M>ZT=TiZ@pKowA2K|!Iz zLwaPA93;&4J3>=2>{3-L#~IdJoc)DM6(4_j|k;?ek9I zFdNr`>nL~Y+)!AkrRHzSALGh}5|MNd^%!|=0pG}E3+KJJ#+Kdn|!WbUZ7b&@y#znIfi%(7ACAeb}WZ#O*&UO zrKuDmS#(9_$6ZF0lWALy8ix}vg)pYp>*eyV2y=N^?p>eLNBAQ&DaFxvVz7><$cSc3 z-IvmMtu52j!`2EtB^8;ufr^!?I-HFkB2adAe}au6T9h8_bQ0ZJs)Tpsd9)unV>Q?) zXWQhT?d|5?>{@Q@d@Xm50FI&4I#|mQ1ayMeafvw4sKvrKhg*?khrFf!Z%gN)@RQnh`d{Nk(c$C)!tSyT8+|0SV(@Ud#_OtvUDvze4_G$x-^nC@X0i!D7l znzCK@L<$NM6?>mDM^-Z45HwGYApVG2X|$Z)hqX8h(o!tu`~tR%YJDQ=|67;${eye~ z4R3+T@PsoImlu_>IXg0yMcXq-wuLZT6W|<~v~9yPDcr&h;gvffz{G(xPQLKd#mI;% zHJJhZh{X(Vc|wv%B&dbYJAY^`CI*_t`fF~;xTu=R~K>)##S;r`4N2h_Y3 z+`GTKSE%cE$w#r%-MZO2zi+sbI!>*zj#KVjzX*}-q69`PALgN=@((kn0V zUlYfRQKCq_wPpdFQK{m1chsZQS}l9$PZFR2RYgJmT;RpcP4XKj%Wj zL@U5g5Hk4Kv(3@sJ74vjbSh{&5w{oZQ&t!Dk;vH2E;F{Sh1Mtbm(|!%neM|=co8kX zdL%1z(D9!JnNa-8MDe)XszYv;hK@~-ym+z4B3^*>8OVhYf6llzBGr;H_ zc0K0@N}vaDPf$3rr%f7@Q88gjnYmPG14DSr|22}sY5`rmf6BHpz-aoH)Z1l6m7xk0 zE?j(P7X&DSEcF)u8V&M^8c^h#>e|x6fKH^aaQKjtimHjv?Rq)ZM;#yPf5K2@86hDc z2Z?ub%=o2)TAuXPx|jbv3-n4fz`caX{913-1$zYLzZ?YB-2dQ=&93txnq*%qr;)O%K0ELK3h=(HI8EkAQ-}#8#F#qSK#QzPSNucZ9P-K&r9f>FuXWZ1TvU}>-BzKoLPqf%D$rUNKdX27^ z_{3|Y_>#w((Xj*x8`^82uO0}#7fypEK(7P`AiM&<#*a{#1H}Hn)>V>r+>yIObZjs?sP7uYrJ|iB?D{ex*C;DuR1UX9SFQHPyVE z8O~TS{k=xVWyyOF3M79Hg&W_4`Oc#!`=CWq@xEK=>eX$RB0~-rB4Oa7AcAt|!qdHJ zf=~tooMbgprf$dd|63j^cQj%aaSnle0% zZ5VQXtRKg;FB_?@v;hAN;cV}`{swl zvB~+}7MX2YndT(9c5aq`8k61^rP@|%=(Ua(JMFjR2vUnavm~kPWSReD;+t`HG^SLE z`3!0z6%K`)pgK)F{6yS+W?!Jz#3si;2#~BnGAK661RPrl9OkF8AcEL0nM_(%Zev0(}Uxz5X z3bcPhKVsOrf@Z8D$xp>HCE!x6ak&ym>Y=vhT#CoDbv1*+g;%{NW!&`Eyt<_FDw(}h ziL{EPTpU7mLB)E&b$u|W*ny|r=n|C?$LO`gHsMeM2}GquqNI4#z^v0tXzspT%+VCAP8`WDUuZN0r`1SUHg75#w%?6m*rxFYp52%JXI3a9R-Oj^? z5e#N1E5gi{pa9ns`QIr7EGWcigYG4Z_8o$c-wEE4HGf5bCE#bRA>XjM_`~Smj@peN z1otSju>wB*-$U7ctN5=QPAU38yfo;)4h5s?@GA873hS3w;7t;v+|OpD1N@=}3$jvH#j@lIyElQE2jRdLarZ3X_f?9A!h z$X~S<`FgvHk%{StpAaGAx<=++`f;EL$&CF3t5Z``^PgrWk2ZSqqq#}LIYy(O<^IN+ z!XXWss&ME#a_!#zgWb`_cYs#>*lPQAkPZp!_ZX@6`;)beQ2tz170oSpr3azn=(viD z3|V_fHSI&05^AMNG!udF0{3=_UGIN$7AEV{Fz$`k)QiRK-?%!TI zM#Fpep4uM}HI7f~PRzEud0%L>b)lw!BAh9g`<)N~QQfCEYsM6T;{Ye-5LOV@gRUSW z0}n7t^G4*mWx0ncxSfgb_c8+*;B|%l*T%&x^+X*FfI)6U1Mx)p`Fx&^34|{FdPw^# zWPRGvUnEmM+tr#3@_VhvfD;5a^QPJqYs%<-^k8}O;T-jNv?P)M5ZV~1PaR#Ctm-}M#Au%d;J2CGtr}9kg1H;wXLaS5zo=%5pwVFbQ*kuYUqXZjAL&1 zP-EfKR2R91`&vB^Vy6sT2JY0J<%Q(-OSEW;PsocgFy;5nAC9(XQf^Cpp1ra7Qg2*M z`WJ1`hyaSRkcL`|NmYN0WOMSc%Oai+EMNRuRC#|P9>U!dM@M3Nj zB5ELbMWb%PXXxPJ;IFQDaLGKeFl1rzmNw0~;&^!LeZM!Y$?KtkNUYa<4B};xfRMGT z4hx5t;Y}N|m&$hYTF>e8EvD`N0;@V2D%7-xL{I_UAB~NE2AA&d-<;iV)n%Qz$FZJk zgJamv@9XuH08-Y+H15@B3@(;WuC!b)vFc1p(rG~z>~mVrD(~!VCun^n>BB~RvWh7y z1#ZRo=&aI5=pDt)!lrj$-g~%JM2;VDBCSYc9|s+3c>N*rcsh16f&&s~Cq#v>s)* z!7oQoJcL0NP}r0}#kiv?i2|ZcHu$5bzfL~UQ4wr2*oR9Y%9)>-SbpRNl??_c183*U z{z8nQFCn3+Kjwq{T^<{0H%sWH1+E#U>{+t!}e7i+ls-I5waoj?B zpO@qB`FYFNDyTHKG@GSF#KmnsHtn8O&sNi(M|^yRLFL#%9y+E4O*aiMmnU+E-b)DF zteclxVPK%(=8~1!yK^I3ry~@TTE#d}nCF|c4sz4w;ouz{Lf^x2!VDEhw7P}0*>nfK z|55iw?95?Q@s*;B7R&|DsnTWuL9X#CPz4Js$nCZHX@9uE(()m>!4h8A8zMypXnLHO z>OcWo?d02`5-mJUxmnE8TUONy8DV(k%GM#z2A2tCaDimNhOqL&5%dZ1{!taW(DgdFcvAf>CGHsDK6Oyzv+JDqAa?}7#Q7H{`xoul2zt3FvQ zs6+v7u;o!On1t)_lScv+d*M`(%PyH}s9$D6KJA?Ne&dTEpx9t4$BMrZx!Ncbka&?h z(gn3VZFF$z+1DGizncQJXspnzw&!<(U{!MzW2}c9+^wn#8nC*hg(*cTKqN}a2hAKe z_-XyjER1ouVZTL2t{|vFj_;NxJDm1EH=aR^xw+JR-eKL6hmgYj+OJIS{g|l}`qxO_ zs&_$>D>Rmj2{`C3kZVqO^o|S3pKC9+-z1=|Qh!usddO2zA*g3|y7C@tLH`&hDHE|G zHi(nuRbyT7O7joS-E8{C_!vB~&Ql+WJ=gSq)Rgb*<8jB|p{2K6c6`2Cy?sh4CPh^s zII;r+hnBKxzJ~0d+MZ$es9JE3m7X~?gd9-uy}R|&eNA6Ukui+L<33wZ{(fvms!-(7 zli>y;>h^;+3!Tw7T=gKSEM+%io%wEzP@hx0+bY<5p}X2t$zNOS7vq6?R*1Z|W@0t3 zzXmodsd-uZHyV(_X#uh%>%Q2PE(htQe3IV>)qG1yVMg`Vd*ty|;3#DMd$?*ect>I_ouZ!*8iSPNP#jBHAGdF;nU+tGT{9W;_|7Emui1 zJ*LX|wkWBYOUN|)L{q;k>+kN@2R|dFo+`P(n+>sQRdvnydtgm@yH?N_(=3uz!Lf$G z^ZIy4_u}~YETM2Q1B6@7N^lM97Jh!i({-7s+kNVdZPc`b_II&iA!SmtsR=V4Zo}v% zDkmqm8jmeR%;dY3clJg0F1gnES!QO4C!+4Piy#Cwa4{ZehRnJfZTp-_Qz>;;1Fy@BRy}dy^UI`3zi3#|0Ic4cFJksc60r010A>KV5#?)$19@?#gp_ zvu!En^8%Sg2FKkzbwhh+kPNU@J~mU=Z7*?p7lKJ}iK^0zx8JC)y{;b8EaO&|RqMW7 zFkgC&66@`-IqMJRypLDvzOOswRt=p;{X*T}4GEIG~T79ax z*otQ@XMd;tTN2n0QM8%D-CgG#oG6RT8(PSDeZ}6s7*)MFMeG&Gb%r+=`BIW8+Zkf9 za5@F*)k*B{(E?w~;>7D>ZHlmvRbstU@h6PYciy(=IHL_Xbl4p}r^U?Ubh_mg%DXy% zHbY$4dN_Jv2gzf#HCiAe}MOJY#tE6Pxb2Etl@Z<5YWW=Q9#!}bY;N7wc{@Ig~ zPU%-xyM+b<(RnJ!$j$U(?Le&UJea(ko}8~*FreoL^gXK{LE~Xv zlOms_tgN?D2gA{1;$D`KWhh$v3quMuS(d9(S7152e@k5PsAR~>R+w>yPrJRjRB^){ z-G+pNgB{GO$K9*C{JYLs$A`~zu*5l%C)Q1qbumET5(*h;B+QbYC<`9uP1cUVdhfS1 zqf58r>aF5$!;LmK^MxkS7boobw&2J}!<6$&K4R1zxeJXLPc=W3G~;0e2YV-uf(o!$ zvVf7OLCtr_V(~ath*@WkO$E208s_u#pE^v++j^+6hy193yd_80nYyTsCT7Urf!uWd2 zEb}v1q|)uTkB?I2a<%YvE+s+^S3@G2tQ3*BkN~CL@6(%FIU3`-G&y-vqVNERE4gP} z(U=960r>Gi7ReF;qtvY@0H_7RD?3Nz|t`n*kzZ@W)8h?8@p9qM&9Wh%j zA3?67Kr2TowA*a8Z+Y&|Y-MV?J*PmSAE? z@5_rAqPjl@y9-tz)qi?xvSh{QaNk$TAWD)e>0cWd`#EguZ4LdE0$IuP`d4R{9v5#Q z>E6##mn#MeK?Q6Z#05>$+Q(>|-1!>2|o+bq=Ea zM!#w%wz4!wGUHT_ZEyF^kUPbBfQF~R(a^br)kV#yfMJ8gGcKcVig2BUv%kkgcpTJ! zDZN*kUf-BC&Te3Q^pUqa*vbtvR?PYy#e;TP-AY+Hu^unIg>y1oG70~**=@Q5$(nk4 z7}yAUAxbA9L*;4rKDk|%azOmva22KI=DYB726~z`d%E^Nfm-Us5Qk@rReP%(Zq{n+{<6W6zVbA9<+<^9lb=wj3=4 z&CI9P(l`AZ|FKK*xb(W~-eJS*-bw%YM0yQu8cmy2v(2j8U?~zid{;tHfCj!SyZzZX z!uaQ)yX<(z1&j;t)Ptu&@(>dJyAZwJhg(KV=3-^+*=pFP0DNB-9H2PBw$6Ow;oq@e zE4(A*lJ6#sEx0EqBXow$?A^L=o|JlWz6e{X@vaw}&L<{lBZKy*R6W+adaJ!IuULl2 z5wUkN7|m4AD_V|R$jqQa;d{bm(o(naI8Ack#SVBoS*=Fl0wVlsft%zx-df95n&;;S znYRs03|?kun*7G3uIDJVl54gfAu}msIv#MjHfnIvLCzl&7tz3(PgM&eJXSslm)IZhS*2BLa>M>#B2tY_eLqqHK`Q%_{Pghgn zyfWzq4n*#)O4WNyjQt+Kzv@(m=H(p=G6pB_y%U;}#XLR_!j>WKG;R>^&Ha5q4vUMF z1LA1%@|4kb`;;A4{`Y6Pl$-J9K8)K~>N^O_W}o!hEA4~;S1ETsWj5Wqu3ak4HG46426oCQfUi^ z1Zlumff?1A`QBcCPacAC*X3FUeMoQ&8-Cq zV@8aa%mQv=LnPXfxB7;xBGy*r(u&F?s7VqiC~Ei)LKzxr-0ql^vx|AjD!^@ZKb)_qYc0h;OFF#%}YD|^UlhcW0A?$#4lKc4L-4c6bCN9ppqbee}YpX|%hbNLc_=a|+! z5jc(;*I!CZ!5r+k>Y%L_&#oE2=O1AIJOSTQVOpT``U+YiwU|eIEni0%;Bp}$p`)Td z0b&TIorKHnS}q9h=R|!EyA^p7G>E~)H{@lz(;E+AJRgurI!iS{7q!-TGn$DCR5)Ru zCd27_-j^-N4D1F)5&Phx%_1#JojtyPy;*(zkE-9)#a@=7d#6#aJK+aRER(w}OageY z6fmH*=C?@YfEX^ItoQqOONdkobPy~HE;9RtKQb7WI29-faO{kNlAjGlH2*_|8VGW;;VKoD?En=XQyip^G z0;W3I{td~UuvaJ0HtvUx1hDbJgI%gIHgjw7j%$+-MV2^rKSxybuM$0bgQ?9684}*d z$B$$VRZ{bSWPd`09|qk8ciYmronJR|b7r%|s{&tjFf8DyJoX!S%VF)R&D0#$LUo|= zZ{W&ZC{lNt%;YY`|AHkEdD`a)rq13yn9kQL(BwiiD6pEz4!a!aW*9)mw0y+_G;%sX z5!-F+b;u>K`Sag}oNX!K>^l?$*6dDlsiOcV0uG>K#eFj!;%(Y)b9Y>8m;iT_OQ%_$ z>^tm}XyOw7#yEmNFm2~_-h=MO?bn))4QiYWDOxuO?|jN^P(V|eVtumY^+mj zV(|8E?i}qYl$h6XHSZ$%^nnGU$97Ijb!3cDgXQatZR>xNB7eoENqMMm=60-nCwCp~ zzA|WI`viV6sJfP0n(+QvJ~dq0Fndfen&PDBy0BG*STN|iclW~zEs!3Jgr_BIpv~c^ zp|KIB{-Tua|6i3K`F>CyfE4-!v_^o-9~FP}fSkswJ>J9O^ZG2t!Sez(3+a4$7YZ;- zAB5@h`FlqV1%j)Y9~d+&!BX-|i*#&kCUM`}T?<)cG+LWJv)}}rg7Xfc#?c!xgO;Bt zMrfK}FChO5ngezC{~FD~|2SXk=3#S|w42gZzagi}_DX^$ap#f-WzE=pH;UxQ6Rt^% z)(Q{P(?bX1SISj5tKwmS^rVds+zl+=)E#Y~}tkn$ith3O*&rlTYZpcBmzu*NMlSajX_ zPVYhC-q;g|sO3rt_0Bs`U1Bz0iIVM4mm8a50)>D?!#*Y`JzfJUdo zv$hwqKVrC0QN;Do5LlqtZe)Xg9$5|C{znH0jGds|N4lxi~Y0*f;;98l!|df z{V}XPc|{$}%7KMo%9FM8Hng!^RonOMAN!~lVhbn8@4tnsn--ye&ckzona_#4j;ZnQ z*b!{+(`?(sf}b&nFv|Zj7Gbuth}?i&6`Cj+gl`hE=!+u2B@7Dz1yGw1ohq7r#zsd^ z7t4|3%UHjp>E*}(!Ic{zNWg5|VzcGo{P~fs3pix~fV+sl)Z!fdbok#Q#j%TTEC{t; ztm&H$V2%6pF;V<)*hmt|ZzB1*S) zhoMo)J4Z>0m6J>TEYU+i8uNNt|4ilmXFIbIOm9j-{LJ#`*^QWvd}V$0u{ zi8=)(nr*7O?0nQZJe5BfCpG@xu%ex)8+ZV26VM5lDFp@4W`%=`3rgU>%gW>^PPzVb zwI_miMFK>JbISjG*^i)K zQvcQ4?Bsxg-i~4;mCvnj_6FA$^9Q(Iy_|}X{a=2NCH@1=12_wS|BM2ZPZ$`~==1tX z452?d$kiRzXK*_n5i!n|N~i7M=qLyveS3kUOoKwer)2_4MpnCk2+t$r2jQm{${NS* zLf7b_7g}Y?#E}CVj;^jQASC|JUv$W`BO@m#27pFm0e||yU`b#p2(PrGgA;HCgv|gF z1ik#R?JM-N(Zp46hbJEX2~gDkqlu9Juc!6DulbiD|5x6u9jqu;pb&x@#E*myeCYTj z7f}J-U*Em{@tfhteh1TOW*|dh=k?1K`|jp*Z<}K!?)w_KRTkUbJY7piceu2NrS{ZZ zL${Ok-=}ail1mKrKB9wWP2C;M$QC)zikv#HjnajRd(3!0*RA2_MV!Z?0(FE>zN%NE zDYZapMcuT&hupt18)o!6bYrb2KDK7)&eiKLmDf6mZ514!H0Pxuf)T{pXg$63&jA!9 zG9P$R*X=Dwr*cfqwoK6%aQ8*-0`yyH)?7EZrINW!h!;0ekVhL_9pNW-7as!g6~{Zd zPQZw}AduK>tE_SH+jssu&!$Y1Kwm0SvGH~Po2M71~-`Ce)^jAWbm;8S=vFIGAyg2|; z)JwzY6Bk*yfTT=|1q2{4?N@sT&6A8)f}V14+x&$D`Xl18zUl^U1}dW0%BcmZ3DkRW z#iIER5V67ESgww@7BC#CH=+>cm*zvk!~5Rs^qQW}Dyu!65`5mRQ1@l|seT;wjQFzs z1i;`x!1&5^zk1c0+C*gmDfQ>wLLf+A8Y(K3glB5;qOC~_j+K7unzz1V;B>s8?nC~y7U5J;)sRI@I=<|$du1=M)Y-M| zGm2-pHjy^J=saNKB6ed-Skh3&rzJo3$xe^`6$6MTm685WotEg!^J}VH!`L|+s^(J_ zPy7zI{?Mp@zWx)ZH*Xj2Kx{HKi2<-ZvqHFuTrVa(6<)tPPxe57UFKnqZ9b`w=GT z&vXI8LS$(;yz;ubva$f;G?uxe*C{QYojh9Oo|(II9Lf{Ros4e;0U65F5#!8|GKOhL z=-_zlOO8`l%-OBtg`~d*PRYRXGl15tRcpP)4v!a1g~3w8nw7CIxS)9S^wjj;Y?_l( ztU+K&LxY3m;c`L&*B0F#`OM`y3hHq2bC(;@*~Qo*+2qe#*-hMsN+btK&nf9gYaNZa zTyE?4jpFHy{b8SUSy@s%PMaOb8{beuqAv?ToZCbsI3#r<0zQ~Ov(G?r6h&G3G9b_p z{PlW^bIQEGf9Mjz8mNJhgw|DUx%E=0b6J+(r2c3{+YJnSn2fTo8c^oDj9^CKvN2e< z+6oHC1AUufS1l{9E*$9D8M2XHAAjW`MD}2D0Osr2|Jzos7@+wCAJFu_S)fwYi&P@Q zXoUvv=%NGnD(1+WQFAvzzE3{`L0;>hU0vHS`dl^AUWs%GB+zf;Y>yv~Csu~6e*#ln zSsvkC9b>gK9ZcEiw%iDgNqS$ICM!~&8mR_?TabUCz_1mQ8Xq0ulncpeXy_=sX_k?} zFUoX(ge5A#eR}(cSz|8#ui%S-Z z_Kp3vBN&L^daAM3yUX2+$rAU8A*4x(KPRnzg()%T0L!&eu&b9JIisnDZZAw zr;O>IVU}tUt)1W9)bY(=@-gd}I!6{9_8hfbiLTIdGwvu@5c$E0*v9wE^Fc0=hd7O6 znY(P|3D?ajotmT0eQYXdYf9@<2G{-4n%W*peZAzn-@S0kRX8^UHCE*M43{h5asSVI z(Nr}EIW3MshvSKkuP=Qkdja}bM|L>-SI)8L&sVPdBJfI|)f z@o%K|0T5e$hNFC~=Jy>X!3-KvMNigNu{l0fWnx47-I#(lCD!?1TU3z2qvY(Id1mLbW4gK$Du{{&eI15kl- z&%q?fs?>1H&{*>VzQ|ZD0Z-E=m&2-DLc+R3W<8~Q2m$*!9RmL`H85c0R20Rx`14~V zAds9;j1wCL01?1;tJ2V74krm0Dgl6pP;3$WU+`Wi)y0}z1oVEIn-1jr>mJZF5|%fw zy_i{=O^|+eaNtKkIq^6>PSVh*R7>gR($e2umwCt?I;Sp6&R>rJ-89IDy0fz$gbe`= zzNb-F%{a~XUXXfMSZ&aI|wFZ}68Q=_ksJr)1)S%@v|aiKkG47N-K_ z4=$Joi71mrAnVjf^5?^x<06WU&Q$Lzk;Zns#R}*Alt>bQpy8T9o_Tiey>F@50MDMo zw_K?^BCUjrn&IeIiH3y`u9!1%PPAJh^%LrwSeXo2#1UjxI%ADxzX46ET^9J@@4cP@ zXf@SURcbWLrmp|5=Dsqht|eL%NpK791b24{9$bPu1lQmi+#x{&1cF0wcMk6Et_OGb zgERZy_hxFQ=Fikjy{b7s`*iQ_-Mf4Bl3w2j*L8|4Vk<|##abYSY-y1QAzA+fpZ-M3 z=V4!OD)JN(jU{ckyz9QeTP^EQUdpdKpIku?7M=>qBcWu}Hd}Q+KK8b~#I;dQ%4_@o zGoD%j#8Y3E-`CsFU^S4CtPOd{^}IZP{s4O-RJJ1gA zar&p){Bn<)=oDTsz4gkcpK5^qHNhJl*$(C`Ykb~@zUBKL-mfvSNf?ur=P5m|2J3Cr zOpu+D@>Q|%X^F#{cFib3JWvMQjB>vGcZny8O8KYh)5Bp2T6F6noUgh{T3_~8!PO7e z$US8)U`s__7zfQtP#LoGw?f6RyIlT43l^jhX#{z8%7Bs0nG_^$!5<7~?BI6($R{(| z(GeZ2Q;XSQCoiKD+SunWWKkPF zqI=hiP)7>8c!B?(X&_qq$^QyHwJJ2JF;t!H-VtS7+G;sV>;Y>QF~PWm)K;Q=fqr=u z_)f^tBE_7}aWvi9rTlW&3Lz1&C^0Ja%h<~tTg12FbnKcEEx%LY^szf5)fL`qW#Z}F z?L7?6x}lJ3B)cu+ep(Bdr+CfYDF11XPLokZ%x~8J@Y~YTBcN|uYiXUtnJKZMX<*IW z+T~kjFDRW?*U4v2Ce<+E09^fdW$CQlMd$s+_uCuolTqPy=bvM9ImNgiy1tnc=ctPr z=qZkV@_4nfx^K-3M=xl4%J|e|9-^0RQEMUHV8B2AlWfI!Zb@(Dr5qlvvL?;9?6N5d zEzsb!hxJ5zAGhd7Qj=@CH%ng2df&*v>9V_?|EIZoKcD^EbWU4huK+iTisSioi*IfW z=$Wkd7vy6@xyL1S*uFYTY!IgsilKDM%Sm@0pkh*M$v4Y(-roz;qmk^hA_Hk7jdqcoXNZ9!RGP)?q1?O)4@80-#a z63%j=fOU;$#PH>(bcKMQD})%?fR^!gs|6Fv6TOBCjzcW}3z8%Z zTIf)i^n8i#@=x#jbl>u6H_1s+ZVUdTQM`m=baXQ=!gep)JS4gt4l5tDEQK5dPoL-p z&B_TQliI$8vroyNigd!d_OJ4&O7cw}!1{aF-pSMf~ukNbgM+;dg3d3VPcB3N_9Hvp~@wcmbckdIgGhn{*{va1e~L zv@Q3a3r&yaEyZVCetUA=Ou~U2@Lzl#z6&h38+sH_XjR2=tbEkC$ah@-K@=f^>_gdI z3H#jp9@9b-$gRYaN4Ue1Oy(zoOO#EZ`LMT+Ahf8ZqC$?T@xKC0;f_vfegN|vt`-)1 z$%jRKXt(MAK9G|(-Y&b;SWq1r#?bPOHcd>RL;x(HvoUwv+v0JKf{MDy&bS)hSkKeL zIrd-b<0~h$*1kikXSqd4Jr*>su4a(XSzrA!V~6lEc=9i(lj8M(C$r7-b2I@h>%bB` zUu7fYhrpY#(}GlURB4gr+DO6N<8AdFkZq{nKC(Co@x~pGT|ES`SXbo`{ymTjTTA&k zG*p!l{)py&x;pfW#-h%CL7xGa=TyKhWytp}-%=>d+trcG_S$SB1RP$?!Bb9vS<}?C z6bIF~IJCyE80P8#?w*!J9!CvTn6|RXL19q*_S7!p4-zs_4T(MPXKZ38n!ks;`FV34 zem7opTds>QEp_JPcsfxqU188BmyB}~33hvFvl~whr7ZxiS&*NDIo6ybz<&r#vok=Z zB`E{JXHb!Oiv=XT`u;I$YpL`gl zk3{_b2=m%s-Oxq$+>iAvCp(9xDl*Sklu~a;W#875;*y=H=zZJ5#;PuvXlt z&{R{qKAI~97zr^W-?7Ht2M7FmSfZ`A-W@bh99`%YaeDvx8JrD;a4SDoy!^OZ=p8sP z&^w_|gBvk~@_@=FWS{?TG6295_=SU?SaT&uuNgCH!Z=AsMIPIOC!1nN{c&%&Na0{k zjFn)IU7L$kx$|qaq!8(!E{hpilSu656fPb+Sk@lXDtzq|Pt4C^Dq=LaLwOXL&og2*e4VpR73Gz zhJle!m7pmMH90}&Do_mh%1hd3Q#u%`GKSnir!zp9C4=Gv5}%Klo14`aDj2b7EfMjd zR`*lFe-Ackhl?tU%dI|uQjn4HX-f!tOBrgR?>s=BCZs6fzErGRr{noGKG=pL0k(|- zR2dHU8Yz(|>H~Y=rQh!JP}+^SUkmIw01tn?$%PhkTm)MmyYxM#2Un@f2CZS)vgk9I zOY$GEr_y50UK_VwR0Q?0R9P?j-i1IHa}$$a85yXJ@8dOKL9>gCo@c8~03qh??jnwD zZ`S+gS1ox9Zf=*a1S!2gH#IQ)dH>a|nPO`Rn>0<-S3HHc^hAeR0TNITq4A|!%k$;> zpCh}NO%WpS_b-*2lKQN+gdl@j6u@zfX!&xLX0#nLXs!b10ew*`5J@zb6+s3=eXUn$ z;}q*MU#27IeuCi#af^*uC)TGg6)8o%=PXvDAcQ%>2iCZ<6g}dI%TNv8+nHYR>xf7RdSnclBEG@v0qFMadA8x5V;F z{;Tkf^d>En1OT96R^m^2&lB1~B82!&5;i9X*%I&-=wUseK|gV9bohh*h70l4?27Tb z3;Kzh-DhBmzDNQ=6kn`6tpIr=1BHv*yQ^DLVT&~>Z9?4NBF$pzB@NXb>PO|U$GoJi zw7gxa9Yf|HJx=@8*aGn?WXGgzM5EySgoQxv^YilBS1%ftTCvqwwC^81;aDO=`6ZW> z1C}s0f2csO`T0qJ!45muyVQ|zyXq_2DiI&gQ+ogeOQMI#abLoHd+wY27l<8=L_6yX zu@`c03{K+*f4Vun+Q($o3`s6J!h0H4y-&i*VOu7<`$;a?UTgY4ddS%TQ%PbT0?wM8snnJQ$T)?>$CTbJkl8 zYmCIIpO6|o8-R~qw$*lb@GJXFQ?pHUyCNKoif3dLA#w$ebL70VT+DK1xP%O9i;|bl z+r$(?OC4I**dKK6+Z?3PFj_*wq+ev#v|%+|y|OJJ4D~hcEhn$#2|hs?$(+jvrUR+L zMuRizUZSfVDU0yl;xpGjx%2-w&XzxmMuvfb)v|JqrHhS|j8Xq(&X$T;sP%w6U9fmW zd2vfe%h-L>L<5NTP{eo)1wvjs0~ObBAaJvlNJ`Qs^&RCv1mfe>9~~8~@>Gwi5EJd> z(ZWydX6OJ_Q-A6H7!`KPmxgaJ-fA+n>gx)*n}DL94N267hNz41T)a>@M4Zkqn+Ha47t48P3w36ZCe7jSO_@o)N>>258(S@Sj*f=%0x+)LQ z0<@3OtE;JWB0+cNP8~pjhP5WYAP-YbfvVTOD#<>!wcw4nPGRq51wBlNu%+&06f|~G z5!4+~V*R|#IJE2x%_4{p!M2m2!~lXCmP|3qIzro157#YMfiSRXNbhmYop+8C5Y-AK zN&TEo#T-htEb+)rm;Mf&ZddncGIs)@;Qt+SAFAsA9dn;0_Tu%!9~n`HQba?;W#Y|R zzKDTM`Vw2!e*sU|#P3QM3t#SNP8FKl{fv#@`%jm+CH$sNGSJuba(*Y3Trs5*H{^V?Qi`r`Sj)Us7uIkmw4Pl}F7b!*EIn)f`_8l_?MAOu#-Je2H(gg~ zd&~Y<7k3h2-|nj1?yc-T;rKMxHmKBZhcF)^jqS2GIq5Hl4moKj+RiHbRUOuCU1obj zf07jpGPWzEmrSc8Sz2El9nSKuAo*5Zrl-pbG9B<1od;xRUp9P#hw#4c9DgGB@e+O* z&wv?TZZfSKGpjo53?*-F{`7d~WK;R|=19&*#?y1XAh8SnJcu?8X_wLSe}?}j{ZIJ+ zm*}c_V&;0{3ZXA?i9aS!)et0M|3V{M!bWH??l@74>eBlkkTzt`=c#E%gX+!A7fCXw zdZK0}7SeW-S5UKoD}Bjg9D>DuuY?PjJGro}JAX7@8EHTG;46Ql|yOSgRT zKJwcqxMoGOT4#8K0j(*k40Pn?f>2@_^VE@K@*ntXJ-&fKUj9-kX7lEgVK00Br(k$b zwOvB^3y4`PkM&I32un*MMbO8OA0tk3v@y&Og0iE2>i>?Q<6zOcSC&9DT~IKFbEGIZ)w3MqGzU~>vhlR@@)WHaPX%uY4QpQS>LUCy=gyRhIp`C zX&6X*dJ$?f^A!^Ki^}6N$uxCW98MzG(B=tvuu<=do3!*^d#hGOBUfTlw-oc5wxs%R zJkNOb{58jTZQb1=G(PM&Gd|<)79`KR%Bi-g{(A+S%OVV|?y%A7^HtSVAtjNgVKlgH zT+j2MdKI_7^|{#v9~j$5Nv?H|f6^1hyrwp8idZ(VWMPwP`QJs&wLQ5ZMOk6wA^5h1 zdS-pfb8?kwlj5c}DbO`ZKC7uL7+tflD$+(x&O>7b41Kw9%RFV_WNgk z$z*?h5VuNn5Dvz2&GBxVNJs63??NEB-R}%J_{ndY8F8iM*V_lR%C!>$#wV&ae4SeR zwn@TohE~~TlAgratv9#mYs#cczQ+$6)om-0y<7KEw?>|(0Z)->BKAe}XAjF(OFxeX zT4$fVs$Fitzd5DqBcQ7BV->0{FT`wvL$pyzixwZF>nN;lmm@L~q(;Hd>tfq*+zYAR zXoSqiSA8INW4|y7+TOWTE#%S#8T{r3ox1e$gLwyCOa3v zo6i02(UqaU7!2>7<@4Pv>3v`x@E66QB~Oatg|mDrJj$zEg?Ha%rc%ab^lBRJ^EWC- z+|nbP^T8apWX{93uvc9l)PfyP<3~~wXAp7tq*1yj77bB;?0*^#d1`qaxziN3&C#Rh z-H#2x*dl3tB`j1&t>6`x!|sd_y$TUl=?vJJH`3IfdWmo%S{;+_z5Ht2<@|*F+p9`& z#nZteH0=~}ZpZ@b!GgO2a$h()+uLx|3n9?I-X6Op_~7bI?rHi~6{45WpvU>#ZkxH~ zzYbAF3#!69D_A)lV_cDtMkuao739m;<>MmI_K#!OxasIpfhzRJt-->oV}eKQ65{Ec z0*kww*pR+#tt~|sd-wJED4OaHT;>nK3(Wmn{6X^ctCUXrYuYgzfcv^z)+Q~YEML1 ze>68}F8kr7WF+LI&Sl~gN&2(yPKn=#tajo|42G=Bvh#B4)n&iGf1g}7jW&cTrF_;H zzdX_bgQ6!`k)sUBiauVI!*ia%u5*bdIv{*njn8mDYY&gX*eY-3=j;187Ls`Dc!f{L zeId`mXWz{#ElL8U7*!34ZXzS$L||u6Ls8-^$I85$HsPyA_kr!=MNqPX`9p{;5Vw6* zy_SSvt7Rpcj}w%D43i`hLAJTy9UM56qGqn|{1}&|{rXpi&Z5iad_fzYroq5uGVpvF zo=IVbN;0;1STqN$)5b4KUs{OGGKEN;@xcKtCz_kFfn7I5){=;FX#*-j!fLy1?hl!J z#X>E#{DM9Kh|l*KLcQ*voH5K`!PS@E^EldskyiW6UHzr|wR`w2^CNs)@xYaB@b3bL z>IlHazDXUVUI)2|ZZEAs)%ErLD&gjCF?3UTEAGW$hXPNte+OIZ>u|@&H*vL!YwRq@ zg4I|u$dXuCK{D{iDdA%6Ouv4KT=M)>2`|l4PM(ad3Pfq33n!^g$Z_SceDGr@~KP6*`}yhP>)s_)u! z2<@3jMl3LgZrWVx2kR|lb@5e}Tue4_fBHy)$_~*m$am&MCng}B&ek*>1EYn~u$!4< zA8*vcMyGBv_e{&#-0LR&SIgUkC-_eg*PHnER2Bo%Mv+SO1%zfU;qP;T^{kM2s)p!l z<>>GEndikFePbu2sq6yph;95-R&zJ!IM-sdFEz_6my7h5biRzfm^z*;t5i>fve&*E zLUckYTS7GE&|h=2-Y!VlXKW$`Z=>!R=x=6&2!(0wL;4<&KjdQss#dpUT6r}~3|cUe z<)b7cFFoHZfrE^W8K@`lyQA&*z50|Cll3Zf6b%`Qk>8X!GX_%>`WgyXLy<{Z|;igE#?zJH8Xo4w*&QD zdFosv8vd+XO}ZUN!NPd}8Y$gKUxY4M-e)&;HiiD z4P(II`E)Psr%R_j$(57EOtWx>jdFPaJy8X!Ho#L#Xj@xjQMOvPD&qbAs&ATZoIPJp zMu}yeLgBJ6hKQQyPAl%gBt&OPm{nR)HyLdzm099%<1J!<-N>>|J?+@1WK@o?AR-zx zH5)r;n@Ve~7D&`$N3G*mc#-|v&r3%~G0LphMpQ$S1Nh?L#{F7-UK= z7wQ?Bc%o7DM)qPki)i5FtJHS4dD{bJJT=HIP!>=rwJc(^y-wGg%7XTlb(kvJkn5`5 zHJ1nXQb2`#ozfhpYPyhJFNw7K=8Eprvei?GM#k_aGptPW;)3G!j~@?4qgAr3N5%c-Tdx<=49XXr_^Fnm>E}bWxf}Dy=;N&L!uK#wPP#Fi(?Gi zx9!|>$WcP6iq%)W_)71-Zs!haAoVc{OWqF#y}LP_bmzYzdjEC;jfto&AL2#2xldud zVb)%u2$C8W4~X&SC1wkhM8TKyf#q&z7@}R_3@dBp*$*PwiHa3RkyA<4SQZKhhth}w zzq&xrkn0kwt9{$|EY{9TVxRn&t!Oy4u4yUA=7KNvGbvZ@gc9rQa{Mz3&I5gQ5O%P( zmFeLDEnWtr39%u<+H}~C zo+g{XtjdfwFqQV$rM>F(N3|`D{Fogn(N)$$)ci9_^SAc;DLvX++-7V3am#SqkWP}2 z083XIlJ0VD_pt=`V@4x$+ssvW9lA-h`x+TUhPwGvZb;VSe9qGt+~t{RH~ZF!tBbfV zS)6RM)JW}gh?e>;`|Nx29o9~wff9p8yQ!p93Gx?s8Dbba=!lYlQ$9&yRA}yic(Fp` zs!MK}v7j@Tk1}Xm%NPqtDWVZYFzMlxC>Oc!6uS^5pm0^87!aayes>CHudO(mk`ON; z)i;Y~;B8#AT+Gnp*CFx29vlVrLQjiM9tQY>(%ai`-#G?~L@{kKR%EQ%y)r3tyVM9q1@-VZ7=)v$twm($N-z6JxDRLMR)8tCdVO5Dd5@#| z)J>FI@MNDOmZhTgNA{F?uw!`+{UYY{A?h4!0#M=uK)b+3 z6MDKhhR_5*rdJIdWLk1_xl#Qpf=lR4)*RRb1vvLo7ft1=t(^Ge-q3*nY}t{|ak^2=rMm?ByIag3>@zwP4QB1{=KH9ty8Bq=_}BLzS;ll$jQ3By zi(Pa;W}_nem?1pE?_){FH@-tKDqvz6Dv*(lR!KJzw!1w$vvGcn_BEkaWWjXPaaWtJ z7nwfno&2&jDYFj^-Tvj|1~RHpUD#S?*uM%T`z=GKaXMauY1!|#*+bmmK_N`M%h^AZCd%pmw>1?@jC0vPb?!*UooT)>Y*{T)l7IT^AxSp&k0Rb0$P2g68GT&($OKh-@hMq3F$1d}g-JN>oDt{Ks_cTa zs<172KASGFgNI@fbBEW2T0M69Kc5djefOc>q%ejgQrYe()6?W19pCk)-Xz2`awXY* z5X-pk_kblfP#S_Ej`5zBJOpD48t4y!ycZUD0ET!3JRKh*P>TM=5fdmS&EB8_N`*wb zWM!5d`H1hlyZn^!U*j-TWq}H+JX_n_$6)zjI8+!|Sb9OkVlFzqET(FZkd!`iR(;&G zvALIs&^aM~CWb13=XRVoKy9^FZ7L094SPREb_vPL%m0jyHeaIU8}xoC3r&QH^-)lW zlFRQ7NR*+v*V{kp0MA=-Nra;rRGWmB0`$E(UZ#!>-&Wl3PL`;tsm~5+5!K3xugZMp z#n0gV$86?GcF)gQF(Z{Sg_d$ZBexk=sxwTa^JC%Rg~zG_!~NsAU920keSxn3(23a# z{{HJ<3n=R1v;?5ZU}rM&e{n0z@`3zPo7r;%upWF;q7DJPdwA6Ca3NGh=_=l1wlmeBsgGx%~5Jy`hMV~ zq-qB=w;+%wA^cNT2?C|qD2g*MI{0XPE7dID8_&=aJ};qOgYq8(a9~{pz%Nq#*&cKM zjM&r>cv+X-;Uu`=u1~&rk&;{X@!@-8?{W9?HA`_K&%9s5f)e6}dx?TM>FKSv`=k5% z`pypD!i&9*X6c8OVmF*(Vq+m!C$5cWq5n~_(y6&$q^HA`MVk&lsfC1K-9<#wUPLs- zX5fLI@Zg&K>JiA-I#&w@iM@~M%Mq;EOqnvAl@3K1y37h z4kX@X3Hu7TpI9}nfZIY=vwAkIrgHltv1p}Yh-H^#BRsCwHhQNwNB?l9q&`8;D-GM4 zd5y9tNvDo)M}9K{M9skJxw^e|gJ6ochC$$HY0QC_NaJ;QeSJC~G2`%HB}dOyX8@W# zj`6PllL-;V_puk*>$X^ziA4D2MonSz_2o(JP?R+6Sn_i?8VQfX8Zi-(JS_vlrTE(G z-pA4LP-MIcgO)qLEG6Rv3vTQ8JR zC7-s>^)%#$BSi3`2P=&Z&dxQ*GwB|t_%y7nm5C}}2f=K7!9hW19x{lps<+1r4n1M0 zXV&5}pZB7>_^l>CE-av}qv!8YW{W||8CPqEp%TqEyV*jx$nz+!`~Tffqy$Nt|8BOT zEvg--Xnx%jTE^3z4*B@#w>(7OqsTaqe6Zx_6T}VhV!MvBVkP1M*;aG^2j+8{`D&P#<_` zB0;>28Bba)kPbAANW>?*ZH=KiH0f_Go|!#8P(%@;F8ObznC(Qlf4<&!MioFsZN(-o z&Oq?b!=fZ9oEpy@CzQlx`aY9MlkYesy*ee5`9C`WOs*&QM28c#zA)v<>lmRw3&cyR6+1sV>S2*5QFB&T{xE7+KauBSo>pX zyq*^u+O&2XRPI|6XMfIm*_`XqaRF+P&m7{pB`z%zNt4 z6_}TmHg69gcsme7vOkfvUZ9vZIyxE*58wiLad30j>owY2)GmGEHIXET&RHKzWAgz2 z&bm4&$J*}fx;`6NeTM1j)ZE$-rBZ{pO_Hj`QF8%HJ77z@MckT#L`Gjc`C?{l>dz2? zZg;Aa+)Fem;=da5*e%9+SY!>ErSiMb@Blp)s3NW}jj)Zfc032U752O&L85pT{biyk z{v2Q2$#bhgeE!7qJzNyNpjc?;YyRMyx8kr4mJod82v)j)wW$hgtF5CPzsBR$X8K)! z-7o3xdwxjQl(MNEug+quKrIDdKu6i_CW~L?B4o*_N7AaF|4Y8NY|N%cn+(6kwd6No zf7i9PwnjyvRBNAPz9xJn_#GFwVUvuTu39{6#id!QiFzy#z#fp1i5PdkJIMlWoC6Z~ z#NB(QK(SK4DOasqbTExbSM_?i61zIwDfmGdk-`K|QbxtXyaT&le2Tmap5kDa+s$Pwb7ag{S ziOf$c?Y`a%X4VUQu&}TOT3qZO*|}NuK>;|l-Ec}YG&E=g9PcbUmsXWGh#NL6ZN%Nh zli7*<6cUEaiDmM5Ayz$@ef2h>N$F@RB9v&5jwkbA)m`ACd3r6iD$8*pV5a}^qBBZu z&(o~s4F>K`*3ZT~Jd4xyw7<>Q!Se1rtshUGg3l=_gLtCJyhP6_^Oa{X#AWisazcwA z3b7*nCeo%E#wRDgq~G4TTnN+B!ao7oWB6fR%{b=<(W|Ta3u^fBOrjcGhc81S_N%T` zM4Bh8OuCa+fBvdfF55_LJ}pIgh)nEu*md13jzNmMe?Nmd-!kOyB;+q5S*18+pY99& zNLMdQduJ6Xp~pED;MW>r;&1mKP|`QI4Xd@_h>`SE{r`U7X?Md4R=4prj2UtZyMF~F zUq~F%>1?qYG&D56=-HtNY#8L>dLIbrAEz>voArF@eKPI|Ya#?>^(?<}&n=y>t2YlG zinbx9u<7Gbu#V5=nYF|kVU{I(c+u|nHeudl-Sc=#qQ{^q7#^$xRH?s1@5(Y73CG5< z+E_GATTvy_d-z9g`9T=0m@bA)`|*QkWTXMN?ml<+8$PDN2v5%YA#O6Lw{ZKN%rDYY2$&)%;FT6U3QuVdD@ zpEQneAr1A7=*Wc%nLkzhNqfym>**j&<38^wMmo&$0Vqbq2aO`B_?UV%)T~|oFfA7h zQU-|o3+sSG6`%2Q%yuf5^>mf7#NVliT?Syi@qAlOG}lSrgdnB5I8K#k4!>yr_)OQM zutHGfKejTVuqMQ^C1?qsFzHQmHZdDZqo|BcQ`v|=r&ohYq^!73-2gM6;a*GLF?gW= zJ2;r>6W5|Zp{;Eb+ciO{0+UJ#YuPVEwNdxm10d;2QFET36VMfdivRpgq(@1$GRQW1 zOI0?QdKfZy&R3;RmhDvy)u+HT4lGQdrgfNkM94z*;zGygmnoc4Okp$LAI~s0HU=)2 z88o}nyQ7f_Kd&~q-1jPF2mms+GCRAIyH=Fy@_J^A$0VU%?~)vz_G<3&sVIarrhac9 z@Q1bs`U&$TC8wPeVdTYe%x{S+Z932oJIQeQA`;FzQvP5P5ty!?{{6xdHBkWw~{KgsOD^W?q#@PXL2E!( zWeO2^Ta2Z0yX*lXe)RKC+@>{_n~-}eSXy^H0CK~{4e0is zMBYwfHvzlsg5IaYiI>(|Vy^#ZHxe6;*3 z+;(DUNLEhHSrM=ifF`70IXF4NW5W^VO9uy5kaxfezgol(?s|aBll!sFSFU-S`4Lba mNQtf|$zp&%#al@`-=MV7y +
  • [Configuring policy rules](#Configuring-Policy-Rules)
    • +
  • [Adding new allow or block file rules to existing policies](#Adding-File-Rules)
    • +
  • [Removing allow or block file rules on existing policies](#Removing-File-Rules)
    • +
  • + + +# Configuring Policy Rules + +The `Policy Rules` page will load with the in-edit policy rules configured per the set rules. Selecting the `+ Advanced Options` button will reveal the advanced policy rule options panel. This grouping of rules contains additional policy rule options which are less common to the majority of users. To edit any of the rules, flip the corresponding policy rule state. For instance, to disable Audit Mode and enable Enforcement Mode in the figure below, the button beside the `Audit Mode` label needs only to be pressed. Once the policy rules are configured, select the Next button to continue the next stage of editing: [Adding File Rules](#Adding-File-Rules). + +![Configuring the policy rules](images/wdac-wizard-edit-policy-rules.png) + +Hovering the mouse over the policy rule names will display a short description of the ruleat the bottom of the page.For a complete list of the policy rules and their capabilities see the [Windows Defender Application Control policy rules table](select-types-of-rules-to-create.md#windows-defender-application-control-policy-rules). + +## Adding File Rules + +Previously, to add rules to an existing policy, users would be required to create a new policy and merge it with their existing policy, or edit the policy by hand. The WDAC Wizard allows users to add rules to their exising policy seamlessly. + +Selecting the `+ Custom Rules` button will open the Custom Rules panel. For more information on creating new policy file rules, see the guidelines provided in the [creating policy file rules section](wdac-wizard-create-base-policy.md#Creating-custom-file-rules). + +## Removing File Rules + +The WDAC Wizard makes deleting file rules from an existing policy quick and easy. To remove any type of file rule: publisher rule, path rule, filename rule or a hash rule, simply click on the rule in the `Policy Signing Rules List` table on the lefthand side of the page. Selecting the rule will highlight the entire row. Once the row is highlighted, select the remove icon underneath the table. The Wizard will prompt for user confirmation before removing the file rule. Once removed, the rule will no longer appear in the policy or the table. + +![Removing file rule from policy during edit](image/wdac-wizard-edit-remove-file-rule.png) + +**Note:** removing a publisher rule will also remove the associated File Attribute rules. For instance, in the xml block below, removing ID_SIGNER_CONTOSO_PUBLISHER would also remove the rules ID_FILEATTRIB_LOB_APP_1 and ID_FILEATTRIB_LOB_APP_2. + +```xml + + + + + +``` + +[comment]: <> (## Editing File Rules Coming soon!) + +### Policy Creation + +Once the WDAC Wizard finalizes creation of your edited policy, the new policy will be written to the same file path and name as the in-edit policy with the new version appended to the end of the file name. For instance, if the in-edit policy is saved at MyDocuments\BasePolicy.xml, after edit, the new policy will be saved at MyDocuments\BasePolicy_v10.0.0.1.xml. + +## Up next + +- [Merging WDAC policies using the Wizard](wdac-wizard-merging-policies.md) \ No newline at end of file From 8830749a15bd2b3f035caffb45a97d4dad5ef36d Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 2 Nov 2020 15:46:27 -0800 Subject: [PATCH 008/206] Created the merging workflow documentation --- .../images/wdac-wizard-merge.png | Bin 0 -> 26245 bytes .../wdac-wizard-merging-policies.md | 13 ++++++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-merge.png diff --git a/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-merge.png b/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-merge.png new file mode 100644 index 0000000000000000000000000000000000000000..13d3a31cec43e8608133e6265cf991db5f661cd7 GIT binary patch literal 26245 zcmd42g;Sed^e#$;Qd*n>#fujS6n7|4+=@FCcXuzv-Q9{?aYC8|DemqP+yVrL;9S1* zyLaZCKj7ZEGw+_v-aC`5*?Y;e*0bKo?@H2`??~REprByN%6wBrL3wF~g7U)U?aSwt z(a-e(&mS*bRi(vIYDUT6&y&}dVv1rYDE0C0?~PHP=jcu{I<6=vcy9lV7b_N&UMMIQ zB(mSc)V&N5FjRfDrB`Stu0(cUe*Ap-%f!>zq`fQ<`a%p>Qu6D!4=OAd3ornaM>P37 z3*I_x)L@>n?vDKBC%q-@G5^EO9t+Rw;@c_1Mj>oA7ZrICbi2WJY1i! z5WDbib|~IDSW*%(4Wzh9rpXm-MqV72a80lN_E+k|8vt_W3ueCQ6?sj0M}++j<)8BU z!NJnDe^aQzm48l7&V14e+RWHwz~W)p%3U0Ww$i7b#`v+Z)U+$4%8+w)`zSYLjMo!L^$S5?s8_qYEf3)g@ z*z|6)(8-w<7KkL?Yt`g%Hu)uazUOVeNJL|9ktR=U11PtOx95+jUADgJU)+5k@OIZuJgZ%m{Uo5H@Ey8^}+Ns+S*{36cTblt`^{$O^ap1S>^Xy6^-A*^D`lkXKnio9@j?KJb?1;v+t;O_;&nY6}@ zM(be)KG#r!%a5f-G7)Fm(+5|^nB-Oy3t%P{m?x_q-S}8*(i7LBs${#Tbh-!a=5kw6 z_@dH^3qxn@k!{auaqg>SOwr2)3=<0*`ZbQ*5nL?ga?vtYU`~G!Zf@fhuFhLiEnh6b zO8PD5(6bo&7v<<(FpewEZ%*~XN zTGob(%SAofnP)a7EYHgHm1hy+UX`An9-vSzG4!8GRr#E4$@&ZH{>W~N!W?I*S)Osw z*6-eaA6%`49AirnY^jF<)2@o@xfOO$f zatDZqA$YKClg9t}&Cv*4^XW>zvR3%arrktYdox)ValJ+_5k{W7Kc`Ws$VS6jJk7>q zwGT@JSW^Ps^GO#5N_5u#i9I~LpS>smhzKJm4KkeN?>X(XAMVX8E1Ro*r5D{jhIrzE z@q#|AMdsV}>jihT?-$c}|7aJAA$_A;(uJoTRUNgScA(q3)qbAmk5DUMkgdP}c_Te$ zS;^6X@L_~QLhE4FdWVAlc`yM%u;-q^>&{nA>SO^*vk%{i#bNM$xwwe3!$+-mPtrjN>=r-N>-ML-X(7zh5X#5EA&TMO=mt^LDoNo z+e*oVZE1#tsndTGLzCeO5&NThFVa3Tw8{2oGw*ZQ- zIPhre2_s5Nv*^B;8Z4SMsj_#>PuXfPT~3ddO8Gdwxo&Wjb%Wol9OdWdf|}T#GQ=6V z;Z2;6UL-x)QP~VG$r&RWALUTW+US{r`cVL;XpBFOOj+)P5gZ@Jd!=Ul5#^aZ^tbd3 zdxIK!Bm{M2t>(B8&83Z;51X(dj;kR_{sZKh;U%iLyZy)EFU!C$JTk6VqGJ0NHye&r zQsvk~SJ}%07F%k{1TJq~gG9MY*y=c@)O<&@TajD*$iYIQcM#0|RuM8RSvk(3ky)7% z{RWj*EzFN9!PS9BRO7jzi^50Vbj)&@ehtB@p!1y(d!3G?njhvhg8kWJc@5Z6kIX3l zC~JOn{6f353bMb=!VaDiypZxKT{g_AP#xsSv617#6RcmJRa#rx6CSRDT)o|Qz!a2E3o9TN+9zmR-A5#Be)xJ5SEe%!%K9D>w}7+8LC$F$O}J@3YZ zMb>rP!#N?`Yg#fQcf&kC&5qn^W@M*}n;T`?-Nm^;9`2ZLFYIBge5LE{3T2fPsOe){@$Y7j_q9OgZ>fH5(Hd-7w8RbcBSG0Nf3pLz^Hr**CW}q6 z$2k7*IXb>n&SX{j$fI0rDb-rj;56D25#jAhsL{%E_0Cy=4+m#luswOH5;IqWxGVN~c9{3a&TB?X|;9dGED-6;W6Yi>v zOdKdiDp1pPFCq}i!q&--`&AikU@DqO)vPlCu|U(sh8{HkJ!^GYwGBgC2C^&z!N7vJ zkppri>fqiPQs-GQ&)~aQWs%opxD3VRC6Tdpjh@iWcvt8LDDHCYQAKyQFO_>^AiOtZ4-p*;tx5J8jfx6RjY z(!11|OjRHm38J%1^ z3`Y~O&2I!I>Q;~Di;Diwnu3A?hTc7!YK8i$z>@HP*yW#V&NCE|`rjeU|NWCV|DSDK zPX(XrUTmzb<<%}^jV{=``d*Rc_0KjKY@Fl?KLf6zSvNx@29_b2e{8k?+J<@<<4D?S z#&VY{0{kcZUJ3twuj6?cQ7gW0sq6L2W`+Jlpjw$Exg~SRw-C>^BsnGfoCT2MYC=N7 zxJW^60*M0_>TyHbF*YHtbI z=#?6yNM0yqG0fMy8}LB+NqMM@JsM4FIg-uG>(&8Xc5y}Udmfe7hK{vg`Ajc^g$qP^V)7oHb1@yLS?TnS$#Fgx&5k{c(LtYZ{BloTo~Ntd#kCi7m!|^5c=vi z6iC{sDPtFp&dkzdw%ZbP?zvo#lSx+wtI3TYF!IEK>Pzoz3)-aAf?}%oxjt}kXOH3S z;FXp131o5x$G3PsdVIr}v>#cfMrZ!JX^`08{Tm0u z3@~Sw&KDPe?>X4jT|%-FHeMJeU7a73?pH%L@m zYzLN@2*1z)i%J*;G+${{aBN*;`iJHiNGa?SmX?J&J)V(pc-)8RaPry!btfhwQ*Rx< zxFsHv=jvB!G4yq_qj6vY)b#Wye+V@#_Hp*cW%IjMXl5@g-?kn^bxkz62RA*L38MVNzA8g2)6C4&Ve$GF+b2A?_eNHvLq%{l zR_kLLE?&ENSOR+;--lXT^gsR6`+NlfA{1SFy;545p~QqltY(8-u5*{4&J4}TF=Dr& zqcb4CPsSaK)d#Cv>xnEylUSFvCBYO%l)RK7-;s>8jWko%Df_&PwL-#i2O;XF z;sL#;2cAVQ%bLJwJUS~QpLsHTT-mtW>;A?w`1DmrVrvr)0r5ljw-JL)pD zE}xexxDRa!ubB9i(08j+Vb-bQ-rh#Q9CD>bnOiP;w8XWqH@yar%C~ed|41zgn6wYQ zyY}8XT9y-;GTg&<%FHjxmE?rPOdvmT2`akf>g_f}H}6#)7v>t$U{i^A8604bI`!|w zFmIAd4fvzjupt#}Wd;<)9>ha~_S?%I`!?GZno$z7NO0Iured@5XDO=F( zhn3ap#6cduOS;8xDOUSQXnboxPh#tB>Z#FsG21RcJ);~xpb-66R{xMKG&BtBEhRmE z<}nPc)-J@XC_uGz6$97%wUE``n9Z2@nd>lVOn%_IS#ir#H?yLHYOhh?So61dS*~OU zT$4_kQtD(FCHaj;7n5TK?~%+#^OPt~A@-_+%F<+oec6GY*3=aywrn3gSG=fVdMuGe zg}uhI_k zhe7K@MS&d4u)J@1l%y6`Rtp8F11Y#zu==fF&KAo%tZ=`$t*gn*XzVE!`%KLmFvbB2 z$`;0JhLWLbg2avxwN=n3y%Ot_6L%JAKsuwfM)Jo#bW$8Sno!Lx)d~kXaXj;+`zr{+ zXP}(o-wU(J6zV92iX+W3uIlf}4#tSVj{;^Tg-cJiGPvUOHM+e#aBE=5kfm#c_fz7; zxOx89#;LEgvuGmWRQg8@ar(m)XL=?3@A|`}(U%Oj9IX{2%wJV)S%u!lWFhAmu+k~! ztx29x;eXv{k`T1k!6Gj+&qG);TcQ$@xFDW+rJ_@o6aBmx=@tD{xmNPxrQORZkIp8a zSWkA=bT9yP_(=y{3@-c^TYg?)zC4~yNF54pQLmoA9y^dto6`YKRFnh*oE#RYhilXR zE4$D~Rr=z95>@BUhD~~fyaG=9!IMNTlZLj4GR;KQaJHN;Db@BPkx^mN#IEAHm=ydY zb)!uchO8wR24|y?UhFq3!htz`qQFSr4-GWFxTIqgOApieCJQvVkDX4!4PCv zsd+-mR*LEa($8;;a&Nxpd~ie_vH1F9<%=T(7P-J|Lt|}0<%CsSHK`!2-}f;bY=MX& zJI<56y0ERmEwtjV=|W+wAzN@W2?_ZXirqZ@LW z#K=+*uyJu#4e|*nk_us0z>McV>^KNuP5sqBX>~cg?2&uM5#TQ!=FW7W-N0VYK@;V+ z_}D@0@a1wAT-Qz7lK+dZN|2xvW9--nH ziue;H8My|xy?gO0?t=Ey;NI6jzp2$f^_uSOZ<1{ci%YI%?UD+j%a#H3R-A?c+A_)b z=4yqGFg**e3WOfk10;sSbm-4M`5Uam@41Bfx6-S+BKt=Y108*gqztzjbyVHWKItmL zdxa#y9{GkVysWa+Jj&-3eB~OlFA`m<@H9BZZ1zx{^GP&T87opnj%{6 zEClfiW$Oby{muxY?uj~8ZhOnj>qZIdyRd=px2ZNUD&0f<81Mn)Zg`76j83!@A*ldo z)J2dtKf`U&*Lj=wSVGA^!$RF_rHwP>d!(Pnr;E3UL%QqDpHa5TmyOpbC|_Pm{l5y9 zX?`UeeY$2!_M*}J0J&za&aF7Hb! zFG2iVViaA={x#LvDPHj13B0W4la`id+8a}_IZ7iP=a-Pn#SKkc_kf)wSuiM$q?1Bi zhTI-X8rA$)yNUppN!9Ho?8XXQb~pHw$KRx-R*jh{Z>->2%~wJFxHOXs)VAN2n(Y^x z;l|jUFeS1$HvRRuX7fhI%@#w0K+liOdwC z3pgzEL1aFEaN(nL=$H(%w7#|Iwze6VDx+VW7Q%)l1P2?ivZqhPej`7$cRk2v`Bn-> zxY5aT;x8r-@y^VVoy~7=5IfV{tje-kP55p0mY4SgONd)G+Ox#9jz7M?(-Mk^iwJlw zg`Q1J*4iOn;nGOkEEJB`EELd%*DQYEp6;!Dw{#)-(luLu=jH88??$Vr?Q25HX1~ew zKrWP@qRUzVnNuhSlO@sN;nKUKxorA>zkfZxzd3J8WHqQa2~AB+EwI$wSjM8Z)zh<0 zlyG3Lc6nX+H`tZWEn@J?Mik7;n`{Gw%HBd%M~!}$ZE-=p-h2G_}$zZi2J>QNZGZTYgg&i5*u#s84>iz*t8Uc3W%0u zYG95T!i33~Ur+AKwKvSP{E8xE^$2ikE!Z zXIH!GnA`FTfPRa>Yp|Pn<8zYhFI5HflqX~)o^EwMg+SVqF<6xx2l&+Yr=S{CcRmKc zpc(_)b^M_`qC*fxy)gJ4Mg)jy3S+4woc(FE%S3up{p)8h|8C9xn*_m5L(vCPlHMJfn8`W`Y0@6fSl^hd5G$js-NI zNr8@p{hxNH?KTJy11H#NJDhA;?zWnQm~c>)UfC6#_a{}HE<#fL-5wEqddG!xenT+4 zZ+hSuno?~A+${yZTS%3AZ%U$9v)DLQX_L`*!^H@Ha*1_>_QX>F9Ok?)qk}X;9OG{~ zG3J!2@?sy146phQ)x91PB`z%I=2pD#irm?HU?oPL-wZ4|00u#YcbKp$L4ouQZ?{V* z?u_p-AckxVZmjnG)PH=>R|`FC#*vNEoE7IMYUAA~~v-JUj z>QP4OEf%3!{kXeYCG1>=+5=!C5y4lxxI zd&ndv;D_iH`{Xbimx%|k;qfD77o=M53R|pF$Z)R>P%_K6)e3nQ>nHd`{+CVWp*HoNjeV!fc zT796~=knR|8KzXJB08p$qd=gPsm0maO%mlxt@-w+32u(JD6) za=SvCw|}Uo!KYnPJ{>?Yt1259)$O%0UGV+3EAyPNMjPBxsUhBeq|y53@b`mqZhI1M zU;z<&#clN-UH2&y=5I!PVz77#)h{9MRXw>Tcm=u+NR!ubf0Hj@RfOA0h+LDM&^o-! zL6A-VOQ4wT(4}WYEHIMQdqt+TzC~tpO1Ii!P6vIY8m_fUQ2&JSk)%-}y@Ihyda?PK zMOis*aK;AA#jYVxoF2WNF=o`-L$}{OJ!~ifoTqe6Vc6Z(l$yUkk z$JdxTOxec8S3~D~xEd$eXqmw3rPG(gDP~r1?9wC#TFa2@=~18kNlx0PSD@0R#=V=S zI)?#jV3rx8sQ>l@>vKVEn^~D^(2RroAs5-Z*%#l~OKb2=ur8H%OEp!0pzWu6QA!oZ zWQ3%IW1nS==@iwgVEtQ%kNn2prED7HDp%vAWH~PN#w&sQW+p3jMi0RXH4Uv2KAu*F z%~r|vvuUM}68_>QWYO}q7s#d z(V>R+KE~IVFo*8xnj6HmIZTEeTM(>W!pxXyDTYtUFS#Qg0U2|1x7BU@bkp)fEfm}~ zOLfLCEYb)kn5FE6PUaUYzphgGk3=XaqLn_S$(6XcxR@|M0T`rabkseTI6OT*UEA7x z&vJIa4LCl#q`UK+Z?JzRR6w<8mNqsvryD((GmVyGn&scu5x%^~Fen3IbmJQa$;RZ* zB`&EB;{)sH3OC=x(b6&chKFPNw);!)z^V^5xm}z@XB=+9N^vr@2{OeO39rRDgV42# zROC51+Znhko}8Xp=6}kkscXen9*c_&MWNl@-$*1qJUn6oW?QeXud!9nwSw1Pqx?L) zyj;7lrs8{n^2yhKyXToAM@b;~h5uabefw7Fc|!B)c?%`x=ks?_zI0MPR4)Ge_pd7) zyD{~+clSJ1j!y5zwaT=Odx3c9Ap*gjr5w0brCG(z$*I?1hOUS9^Y~mE%@TP8ySqHl zYT8?ZZ?z50RB7er<}SSZ7cZ%HzKPxEKQuPx_h?`2kftbdpFh$^~kg&0y@+ zVV!{i2&2sl3{}ziIKBlXlmzk<{yH3_sFf}mylbx{jG(fU9_==Jbfs&*rUs>KCCP*a5S0bK=8)P({9z{>Je%; z<=e3Rb{!2jx+fqYfX%3li+f~1negRxFcqI`_vWjieg4N1W;&zHw)LnsgliJf=*^>c z6wD_L>e3U1d45Y+zF%aU(B@b1^a()|Z2{ZZM&K`NYu&^oM~6el^c!vLQ`}^;&9N7x zf};pXaXW|NXhJB1N-g3kgwJ+H4iE^%M*K~spE*C*hH>%uE$>1*G+NVf`j)}xd{SsB z`j0UQmP7KMtH9|hzvO=}dInR8$yeAsMY1e!RFBC%j*HgGR3EwZ3^<6W=<&GOac88- zXXxCz6W`h^=eQ`0gg}lby~0~iH+j)`FAW+?1E(mWDHpZ}Oxd72lU5B^`eqfqv01## z1YoWfoogy_F4UoW<#yKf_mX}Op}!TCSS^%wxtaKW8)?tfG|KLGFl)sbs1(amQWQ#S z-v&P39-TxNN(@Itye(1Xw;0aAB<109Sk|V+s~?*9LYqRY6eBax+PxkjhM{f+8#rGPsY=g z>q|D-L;*}fHd6ahhqIxOddoS~H>h4$(QSX-o1V%KpmUeUqMpc2%!j`(ao69z6WBh3 z6S?~yx9u5#UitNvQD&z&dwmTqu*G1GX6fk?M0Gp8;v#h~N&`<$v?TQ_T-(5ffPVv$ zZ)*q?{@4xj7D;RK-W-{By*rUFOw_5-2lw~)Pfx20?CC>2s=rYir@#1mCFZpAwnQQ6 zBJ1xMe`9HE{4eGYQ6FWgW%+^11;!s#Wtpfdh>0(>bZx>?l>0+TL2#ynIhYH!gW-J5 z;osBEzWc@jVK!O0Lh^Q%QVsq&RNO?;ow&l(ms=Cw2AjFkIn*7Q+_5NtORX2?3bb>H-G1Hq)^o()T`q^0GLr6}d0 zk@Td6tA-wRZLMjQs8%p({*h5jPAgHh9!R3IjyA?cF{62H8CSlxQ1%O0<3zhtr^S7s zTNEdpu?^8!`P`(zo{se*E@b)?b2bp+Ag{m>%7tNl;J|G%fI5T z3(pTQUG0SEImtK6^#5VjD%6ESJPiB-=CGA zh}G8CR0?}`Ry}$Rv>LX6!6MJ{vEoy=1hOLotIL}{f3)T@d7-=4@Id-&cXLI#V*0OG zH&YB>Pmsu3)slC5Pa+J;d4Dvj2=xZM2L=XaXP=n*i;>LfwT*k4`jRB0Cq{{Rd5>Up zoNv^)^j}f>r2=mw&fh0je~cdT7qq# z73GUZ_drIZLP^r_syTfUTRfld#ok1d^)oZEblhGcsm964SmTDv0Ms4f*`^IM#^d|| zmwS`kiPE|ym-6}aaG_DT?Iwg3pjzDjFX$Bw4b1{Q%C$&7hLVzluV4vR^3d)Ohbrf` zqeN(FsmJX+YLG;yon&YC9D079>MbUIq6Vvc@|<(+j4t&TP;>oSThzlK)51{|$Oh_u zpjn|x*Zk;TiM`;#Q-ZPnn81)W-BOu0Hx}z@T6NMV=zrVv_0tb#ooCMwa4l2 z(zz@0eZ#2k3)Qz`I_ld?wEJ3u_s-{-C~FMY(`-i7Qa|>a%+@;@tfhT;uJD%Tk8)s3 zT}6n~*J>i^w)9^{Xj{D1c2CT0e2rVu)3wT!+Rh0_7rbdQd&>?dj_ATEh#S%o4#xJna#&2pU}qBfgd`1*`*b8c|gP$TJ>Ve5FMH)Tz5SIq(yLhve^-BvQJ z1lUz}TfD37VIf+b_Br5WoaC7*O<)U4JJpGO$WlYE92?^Y}ru{{9}~_WQvC&@RH$Qm>m_ zWmrHx3DwK@pO#L_Ntt5g@;=)V^gOCd4UCQB1}N-;oU>F7zI_ngGZ&lzFpp~2c?UQO zE=~GhV0KDQFvCG=rU#0AMUK~RdH{~G^K?Ka3xQ8|1l3a2ANifP9CR~20vW6?|ITvG z)x>615l^)|i5YktQHWZb?J2-)^5+E)j;1BC(Ia78UPt9K@DTl&!}F$}me_$FN$s`Y zVfpO1m@}8H-RdbXKM$6kSFW-I59$sa+xqwC0xB%=h#V_)jL^Q^1V_i$nWJ1U zhBdSOs;^xJLu0-o-HKJ| zbHDtxuDB-#QGgf9IIJ{m$k(>=Qq(nAWtZ1YlQG3$fr(+ z2Y@osXNX-ox1IP&V&(pM-mB;5&=W>yb6LA=bfY&v9)H0YNboQs!|!@faXr+}qT7Qi zA+r*MR!%{s3^_)`?$X3*dfu6jZ$ty^IwrR(r_S#%wLu<*f!&N6A$k?avVqiHW4>3n zo^y)H2OQsHY9ngWb2;Dd(Sf^fsmM@y&b>={yJ7FsKjfnF_ib;_r5XG;sYFs8;AXAq5HkdW zsh*jMIURG^Z=~TY&IXDd?o4o78!KiNuKU)e-ps=NvU!-AclY!56-x)lSij^z`1?4J zu^347eYLp>4JGC2tBR0_HcOWuX_Arrjm;l4nCF?O2oP>dO@IX}P3iPfN6Lzqijk46 z;LOMZY?OPq{1%NW*@WJb@>E$_*+}#OPS7!#ZoAB`k~^<0+I1TB80QA}H+(kln$g|* z@~gJ{K=(6O0A<^bN+ed}!1;7QH96<@A%HWKmX3}_jR|ymR$iz+w8yk~Z{L?Xuhp#M z>o~>(xK-dV|6t9Lsz9yN;%hv&vEBMofYLu}n0fwaQzQ&?=kslqJ}q7>NlA9Y5!C4; z^}V%Y){wzWnZ0b=&4@|Dwh;Q2~5pwsU%xx621 zu-NGHXqsQbA}UNH8xD3HY*)a3_~?y4#LUviZyOXcjW;i7onKpQT}BC`DPhG43D#PA zngA@){fgDUUKb&%=t#tZ!i?t_hP|x~|D`x7C~%EHlx-_T2qA#xu%CQUOi{xj=*&b@ zd;LbOkM|KTTJO_ymY~M_h45M-_jmEvR)TWd*&RZ{V}zx&ei!?>rk#!y zLVpE2N%muCYT+IvDI9WZVA&=IdeJ;t9 zUs)zz?YwCm-JYwz5QqUc#>?_%XKyD$7^%W^u3xNaot%nFD|XuEeWP24ui6)?45Whf z9af>-Y$iyA#JY2RCUND(*8G-R>Ni}{C7XT3oi7ccV=GUyeb6qN6d{~riiKvzNjbID zqM9lk3$r3Mi7ItqE6jdUW4V;Fz0O%>tAXG^`c2w#qpf0}ctz&fv{^?1(cG-05~x3W z$dJnQp?nOxe>5g0ronvZXbBWw9Y~4$Bpu7g9NJ&z4G-ILwmlqd0qYD_&?qdXDuu=5aVK{-%nItX;{cPj@|7r&$!X*=&Wd7MpU9Bv}?~ktSaS=QnXNtgO>P zkpA%PuX`Q}7n~!?i22He9A}BF5F=$lPKTpWM!K5(y5oPtc2Daom>-FB%=)G+9^N{u z!;Z`!k)m9*>iR0fEj*icy~>WM;riaZjI6B|wAR*cbVS+HuXK}I92><8Xp5u17z3zA zDeV~~Kna6FiwKjR#jXBJJp4HYvOsBHnwFcBh&q!a3FV1U@^1R$)yjt*xF4k?f}fx$ zVL)E6uFS#b=>@VW)bUVv_iyFnv|jPZMS z%YE6l1EWc0HIEQbyLI^S4n>rRmxUz;&{i}u%+V91S@d6?4_06*dUC^zp2uPeRcA_` zk|YW9edrE_AOv?dn7JKi)tSvXwwKz=R%^sf)s-uX$+ws=yVk8$DK3u%%`OLv^hS?N z@iyUaMEANJy1YnYrC1&h%dMW-gH$FB7dN+J^TkHT)wZy!K+Ek3Xnaa@h(vsv3eHF- z(Yqv9UOQk;C;e&eep<2QlT*H7kjMnD3nh$;`lfR*mhD_%m%Fi;YU_yIXDug_bWSoH zO>wbqh^@OXs>_{8Pi%NoFtzIQ4ti8NGsJRYGJ6-fixqE^tZW89yg&5wgG(urp9yGI zsK?9`5@_#MsI|s`V-YRRrbV;lHKIb5wmOfmlKn=Q(n{{CRm;W`t1LKok^2Pm9d(`$ ziLGkCf4jd2h0O{j%}qk&s!HQ5y7g0bjh8Vm8*Q1>0QFXajd~mV6wDwVwyoac|I*T~WIPGBCH z&^TXldeISQHe#5L!S+@Wz!HDB;Mn|>HWX|3Y>l*QE?xwcDPPpHJdU}FfXJ2yWlw3v z9c%8JL3JFPn-`{1)d%a4n;L_B)@qG+N+5O`kA3A_N2Ap&lM1LKTXLFhSGGV#I`h++ zi^2f)1q&6@^ZgwRoLwB;$Xw0_u{IX1_wiYOLBBMSgP)RfTEL|{JUFmL z(H3sKhja>lqTAj5&G=)=M?vCO`hq>WIxdm)G#Y%aL!B*lcgn7|2RZ8pN|7P-Ox_l7 z3;#EF(?5vre;hv}II^`x_Hd>DGNWtbF9W{KsFtvG!8o}=9Hm)?YL}R>JJ8-vV&bs~ zF6yJxTcw|rJI_qB0}MjIW~g6rzc%6})yTn%nboorC&X*yS;f=G$erV|Q(uAh2OZ@^?f)q= z4F@!aySZYL^=byZ9@e;nj%wUhr@z~&M7>V^#MiiRuNjIj2v~;v)~z6cEWiU$hBf4q zuRL?AW+UWLU1wh2%i-iK{JFc5rjf%z^eksYCnf?ez<9?T(L~a1D zp&^@v?p%~0N7UtINHT-+Y^6qY^;XN_Jo!%L1Cce5%exv!Or?2^O-)Ui`foki6-TD|r)D#=GMAQ? z>g;{Q{Q1)g$Q|3K$!BfMF#^zr`EAxV25D3p6U#>;j`0(J9(pKXQzlE(~16$4zX1kweu4G@Hu9#V(kgMrBR0Q!)edPEmyFGg>_?@ zV-sGV3;4#$gF|1$9^~ny4Tn!#^w4DG9`lT@Pe`WiSUgog2T)K>^lo&WTu^u7(=G+{ zE`2U4L*<((v}dGg>K6H->DjxV@e}`j`yr(^MV;PS5PJNBc@$CS>T!HU?nkenpU2t` zpP*+k$oD2mrFUE*l&2;V^=&JX$7f?E)myAq%x?B104umHSc^v>I>D}!oHO7Lo~=T{ zix^o`e~*VdV&9$iG?f`|Vqx9SkuQ2TA-F^DY%O<(Pk#O@aGf8F|M{%4b6}hHOVtj2 zAWC~uEh>YeP+5C-ye8x-AApycnW<-xx8Iz$>bja!$SokH9XWDMeVS@*j{ykul@y9Q z#L1knxSQnKvgHPFg4M% z|3&-2EwX#}S$UrgkvF&MN{@};KSgGKK3$s`biDJ|u^#qF7l)ZMJz$30;bG5oWAuHW zgRkG?>-aIEcdtp2WZX^N`p`OyrM#ouY=%Bp+gXpn;S{D6RS6pxFZ#3eaLAi$0;U=3 zW4K}?A%b+iDpS>*=)0ilF*BACQp7zjGZfXk_1OGo7VDjCy)HL^&(D=}eJOTT*t@vO zs1b5C+KMg2WZ4_Y786JZ1BsFpE~s&QvayiSXl9f)u3235u35xp{a-TcUF$ljVn`RI z*q+b8T&}G43#`!IyFNvp69HCoeLOD@Lezm$$krQcfOu~ zrd$O!HQ={KBNCkRM3@zZeXXUh#*2%Kx3;!c5(P_vj2lyx;(pPm+cLU#e(w+oIF!my zI}~&G?xAUj_Zmn|*VITI9tt7%q3h8=;Q3XX-gv7ud*+#zzpS-P#d6;sZ(OxP1xM2s z%m3*ou^(OWF`q!0DH)k(96P4Yr!HU?8X5_vIhC2>6XbYxJ2K08_DoH9Jm;bk#uFi@n?$S}DXybSFl%5f)YJ7q#7h7`mupnNp)Ul; zS@xC5_67lu-|FVEmqYbHM{K~wM%(mWYoO&U%S50-Vuhmh_rlSiN(jpw?~ah@c^u|osVakJGhj`XCgIVXi^X(W zs_*gSVC0^#4a8>_(Nem)jsM`^D%gxo((+4_f-<5dpuAQB+a3$p??&3rK!A?z>OQ)Kn%&GB>9xX=df^_nF#8i0AH1}h35~J?Wtf_-kI(W* z^-M&BJVXQNe5aIS)Y$Emh9S}p6q~vrXC*AJ@?{Y@xl)yd{I%K4gsL&Xm99(SQ=nRH z<-qS(iMmjIPzSdo<&m2jAoFr$hm+~1;R@laT@ zFP@T@{igf;H%V-%cD>2^`g#V+i%-x`eC)0`_e8~IWv+br0XvekcsDmU0K=Ay>R11e z&))AjCI>i%$zHMm0Ki3MasCH)$oo(IPo$^Ih^M_P(a$_u@pXywYuhXPQKOsH)V`??oCX>GFUX+v zYi-!!jPoJx(NX`LNz_W|>;Gv3@86Ev6+`D9(#ylXI6rj0x(j22Sz0|L{s#oOv=Dv& z18@Lq`KCOR4+5g4lcU7kHDaexUH+uRx~_!J=5N1S`Eadz^9Z(4R8;g9$}6xlHa7l@ z^7U#XEHt#f=ZQL2ie}bdeW(nv3~p2{k&BCqvwOG`3VeKi?(IUm7*$JtJsKJ+c|!&N zf0Zye|9_e=Fv1FQ!CPjE?G>ThiNbdySF0}IMElvh?U$_KS_N|G5+&A1B~D%6v85+B z&uOzf&E#4I)Pgk1FBa1fikj@>#Y_04ZpoS(DW^%<D!N)c=@n_~ZJgNa>ts zB=amALccf3zj$x%ok>urE0|YnuB_jTgOjt7-*snxadB~JDf$~VB_$;r8(XM270%mc z$JG^xyKOTwiXSCCJ$)G9k?1*&u|30B(QfR_Djt6Rh3@Vx_*7Y5UY>M31v$6Pht_NB zxYDvR)0eM*9)_-U4~v}`{m9^dX0$H0htjzOZD;@RKaXdE3-Y!DJ)!lvTen*ucmloq zPt|khYK?03!3|X0jISBKUUf#`(;IW+r2z zj0n5ADa{>dApAFfY?KYHEI;4K%*-t7u^LHP0Kh}Ss(uM$Nm7kj}&b1L17hy>aQlZNOh(GT0eLeBmUt5@@Ssc@jDVdxGxS0G+6_F za9B#f?Fx_Q6RwArD$#^5)1hG=-ny)2F`p_dr#|@R>%~xvn{=OmJv=rHJD!{F;x0aS zEjV4L{R_$6_!j=ym~Q4&?J7FYZ=K(?n1LH)8tlWUI6@4=Ew0wBpX-f6hqJT(=r5lg zrNd`E6w0Nq(=>p&>sY6nlRmwCa6cy`@6yrHnW(kPHMTOFtmnX9Gb$j$ZVj1_X3X~U zOC_lz;zHSKaU_*Df6%I!&?c-^nT=Bsg4}*BTeH=EN!;h2oWa{0PW z7>yO^uuq++!^;Y2{m?Zb3Ln7D$V{9cibS>DRxO<;WL<2Nco5E3&R=PPst|dGviRl| zb8&O~Kis-M_fi}$gCzpD>#I@P@qElD50VW_E_6$@SeBk^S+jG$)T&f>EB8LMAIEi0 zieK#Xh}jT4D4PPB>sc3=i;>HU;Y**94xF|^u1@(jk}P{1C0RpbE`e$#suO=_Vi_eZ zDlae!#uYyICn=B+B$p{z$&B&4?xr+v>Sc1CGTJ2ebMZ)JE@^`D+Tz2uMthWHiLxR? zgiH(}sK*0W2<2;lT;|Zs!pR}-ga5_W0KT&F*z;?3Y0O$mp8rtVDgJkPA3I-NGq#Cr zq!csLk7SF0)5n%k6J5i?sv%@->2l~QLtfhuzP{I(*?h&G*ZyS?Zwkju5!a2HWMvJ7 z0+KlFFa_;I@sxKZQdA=e6;{m^Q>tnj_YFs=`Jswg0@fXxFP;$Zt!AtTDpV`DBx=on zT#qt}B}>0%P(RX*Vvtoz{Wz;}Hh8NUg-yX3@HH zs+h&as9ugEjMq%CHYZW5?2|fan`&79(e35^hgGf@FT1uQ6+$6MQ71kUu=o#)q_onz zucr8FxcL)S=rrkr3L}zk9|ws}IMvi{EC^$y3h4a`Q><>Nr5F>d_|nqEBfoh(!OwLy zm__6AAhZ=q?K`NP|5tnG8P-Jmt$Wlzf>aR!0YO2EfPm7aDu{HH4hc=1c?qf3EHX(aP`VvzQH%`s`j=SD|r{?Bs6p?>H zeY%B^DbjrZ{yklRezqwpBqRg~@2>SrhXr&&uQ0 z@9i$UF$$$2xMf!6=o760)kc&*z0%O(%%=F|NAE%e8cDFQuqduhi#&2G65!`%O(f&Z zk2_K>(&ria0j+ZDRA||LA7%Z3t~D;q@_qE9@>k_YQkbseA_X)xn%IY~+QBIGK?KG% zfdr`VLy_jAB3fNDI@Y_tlFZh`XwiF5FVcSjMGd=ZMk~Y1GeHDbykXW6=heyIDJHjY zVJ(&LOg~yXH?FT`QzAU_O>2B$2X(W5r?s(-jUqv2=%&c4)sVdeAaA8*y46`vP!c_I zzHL?}ix%P_jO|8nZwe(HsjRIRzj`W>qi1Ua4ps-@{t1AahGwa+L*mnyGv#wZ|G z>0Ecd2lViO)Xb`s^xGX6=m)y}&GR7c;P_v~Qn&vz71h5TNWo*Wd__X}=+X0mf*7d* zYw2vKwlDY~dm+D0>ze)J<12SE6g@)D4?UI-D5I{w12QMB=g*%rGk<|yk_8mqDQG*N z|2n$oHHc^YaG`ieuVp|N3tPej0S?ZW|M-0W-IRN6RwP{O*mAxocdnG<%Xj(SPIjc> z2liP_O7&yYk^Ke&f`(cc9ekg0zCbvq23tRP)TI>j`}ig&DqurNn3(X-6ikf+*Hkv! zy=OLK@iE8|Aqq*gONU&_=U-5kIqDs}JH54uw_hmZbZxec6Z2TmsibP!udbLx{yE)| zT9I05=i3{;W0*3d`ylSHz^-`jeR#2S=IFWWrbD!7pszbGJpUSIV9;=qOkrYg%e8#Z zWg~|x_S5H5iBMU2M%lf9JRIyvxm8*KatRXJkyXp@($@YJ=TL^-DZu6Ru?DlNrtl?F z^VrWfTBCkkE5#TYO0swjlg+s}s}okz{l(u zPeYFzuWm;fJ-h8(s!xp)s(&XQ=jUubKn>$<(jGQoRM1hAn5#aK{_+X9*D_B<0tii#E~79kPc1X33?rx)~miS0<6eZsh{U1L+K5wzl;{m7XTuK`1Q8Pd4F1LIYT!J zwBpfnu8WJ(FwM851+THmk@sR_nhD4SL_Qv;#OD74pTU)*? zU#5caqd^a}3sq<0)IP&VxTh_nHLwn0AtkSnD)_e!;_nw@mW6VaqLp{I^ZFg;)O|4_ne^ERhqlLp%~*hZc!GdbJ928RXF=EW#sH z#f3&YfwE7;RZ%XqpX+5WHY#N$;E3+GnOF0Jbj<~)XLWusqU~w?ASr?`SoVS4a+my` z1}3HXPt&}18GqHzloEVbs#>0}7mIvvZt=%J9?<;Jv@!ApLEJC+Vs@cE43s_8_fqF7 z-|(09#RsQT9i^nv;gm}gq`V<@F5fKw65t8;ww%18m1u5T_RqL$VRy5XDZnbpq@bf) zb(m$d2u`R})j9n@T7AthO>@txa>4aDw3;-`>|e?3ckaST zzImyo{!kbXYc`N=>GPbQD0h56+_!P#Y-(vLEVIPFfpnI9K1Z}o zhDBQ7?zBF+L-};QGrXc>7sl6q|wJXiJUwJj0!uXg@*0n~rN)8+9XHTV$v4&9BM7 z!Wj$UuvBo}_LN{IBdbY@3|{>(xH*CAuxu!`XI)ne|JsZ#cKBL2^&bcb0x?VqnZ;J)KH(he&`d+bjclXt@X#aPwGcs%NRKE@U|{j+KQfk z?7|{C8h{k7q@whqK(V4%%W2b2s@7wTpuI&S zrXIz9?A+4HHW_vlb-Mf=X1n8Fc-$~pAqR;lx~G=lAZDRFKUU@A*F{+7VQ9eqelT^A z%!Wpp9>$lj=zzVtGgUTLdeuv{zVWu>R)z{Y3ufP6`ttUr_T$C|?@1pF&K5ae>!ReA zP}s0@!5?t}2&3^nnV2*m-(B952c)F0UzaDwSdAz@h#AYrhfU7Op4xdd z4?I@WO)=TNX3`?!8&rW!MSO~@noF4ctTimW>s^?8K1LEq;Bqk$fav-vBbZxz%!3BC z`dyAk0^&M@7^{Z5(J@+;cS4Z{aVLTdg8-SQrY&}=kX`Vn)|}knNOG}X?9v1}^{768 z)y3Ioz=9^N1%zy>V0C@20^S;89LTbBs<=40E><&L&;B%+kebnEk8y7l$v-|8JFPvn z`pCC!oxVV$sJY~GI{2u=BV&+Aa>UQ1@1^y{WabAU5jFGgJ1`HoM1D)vWRFrC>;7D1 zr(c++`5z3LCs4ccA&QPXK7ZZXFZdMKlB<*%VC6#@X@V|nBR*dEcM znkavMbh4#k>lAnF%cD7EJ z6gf!X_-y6(+a{ggMGDT!%9G?Y^HoOD18(kpHPtKeC-mAyhE1WUlV)LpAKBSrT2OZa z#qh5po>SF^Wd_|T-{xvu3n%$hXQNoIV-JkZg*M;Hi~tUD>&PIJ}!e6sYCny#{aIO??q_2l3l~lFnX@ z0CVT+Gx{O9B52xKGg2mI)$UIIq*Wb0aSsxnT_&MaKAm$pKTX?#GXJs7=95lH^G#nHUA8HB&W;f`UgEHTM1rH+$Vhkfi zorOB<%|4!XLm$e_3EK%l7a%r7g>_i%0mnnV5_*JS zUef?y;j1C2aFziCxmH9OTV^P(pqM;9B zS+9;gp>$}HO+2O3mTGie3`gQfp%1MYD?A5Ug$ds9-J_jt`7~s)2p&c%D+R{7!zz1d zIwk!Rm?y7TV~-TsdcrC3-t5H$L}PVaeWY_Y%yUq+RVF)2-A$U;__bNH6@qwpy?S-G zPKo<&Y8}5bcS|xWRQnY^6$GlAL{}YO)bzTk6Wufbl%l2yu zv&@vUQx=`rG}XL{XJGs@exPCHvhb(U?DAe*Y5M8usRh&1m1>1D8#}7yks~>R%_w@| z6AaSU#H4-dRC?%dSzuHy)%oOV^=TyVqg!>ov~~-*qxJifB2OiDP=v==cQ9|6L3J7o)ff*IR+w4U zdE{HVl@vd_n(T+W<(ITQ8)_dqB7=|TMgB#jP{-Z!H0VthXn1YOFNbY&Yr!84Z~v-d ztA512gxQ5BmK<(LNq~l44pJI?e)t@;w)N8|KOO&s&~91tcVTl>FWHglqmD3z_;qZ0 zCRCf`2+NHqj>+y?UQ^i^GQxD%NTgmI>Nu@E(}qxGejhx^om=0_XfZ52;bFZ@&NNLw zQY~FbJF`yb#M*_{&U9=4*{E9`v{tLP90CmBZrfW(N2d9I;Ym?_iO-;)eww{AH55y%4QZq^oOBx>{7tXE zDkfmuK8STgzlkA(&AA)ize@Sx%MBJVa%Yac<^-1u@Kt46o)v3+$h8#moMau^fTh=z zKvw1~{>6?0Z(Fi0T+%>NC@{yOzDrJ&rc;fRm>2eKG zV?ST-Yt<5BPe6X+IG0{pXYsB3j-0F)Tks}K*B66Xc{^lnzcD%m3*H?4 z(yD1?ZK|T-dHToD0b@_Tr12WnHw0;2E3*!Z-|2?e*OxZLp~Wg1R(@?2bi?!-ocj8Y z`Eej{_{biTiuP6iB&_h;{d1%}24XKUA3A1eVNtMWP_g8M2iX-J)_b|r>w3lR%xvZ<}{c;HStjg7YNWppNj zoj_>#Y2S4l*s^5lX}YFwl+50iw-%9`VW9n0FV0-L_C)RBiO~l|gge2gy9CfT1^KQF z=9qr3m4)b4;3kv0+#BjS^IR0t0)*WOK)cAdVM6pq-(=XL>7*>k5RVZ;XsFRic8u_3 zooCN+2YVHo-*&Q}6^wE$PKt43sC>oAxqba+T8E{{J~)tV5900oXDRF(kN&HM)7^Cz zlO?A4m~SR-D=sJQ0V8r)kUnmy#vU?~K3s3^$SzssHV$z|TI9JcRJ`V#M&|D1lDk{I z((t@ZAgDBHc$~_%RAFvQb?vX-x#Xm2fm%IiW@vCn&p5AcEA4oefM2~pn$Jv8k@nZ7 zJbRAt!G``Kg{Es`^{ma!3zl}pj3k0ccXR}M_eQy%XPnSe+}Awb%egoX*YOAk;$32+<3nqqE zA6QFC!!A~*v(mg+Wv^)C$n*Jpg0ph|t(=eBj$x2`w<{Z`kHYR< zpl!{Kn>4{3m2={&GBsA|#{(j^taS0WkGbxvH<&K=oRaJ`=Pl{`JtUxU&`G1AdAQl{ zQ4)>{f!{CEhs{HV2O@8q_ik{EJdvUkFnfEMG#jD;@x38y*uV3{v6x8B_3TLASCmg9 zeodAo*S2YU*Z1xdA0CZg3jQA);bVvP99N=aJZ#Y*q-y2WFRQtsEyQ92vh>ImJ7uT5 zs~&@LU`K7e?GADL#5#AMs?zuuh9PhRtoGYJDVw)Qo+!h2JS9+3 zw@$(=Rnl%4_vz7F%atj4 z4AMIp+^nZKa#d2`66=-YjaWuO?qKikh48P$9Ua_VMI3!_U%#*lm300iT zEY@9`VmiVd@MpOu*1xD<#WY`lP6JYG(l&z`3+M00aU`asjNe`DhVq@BtwVO%7UV@= zfBI9b$8B1$RC~auC$Uq?(-F-mR=jgG9G0Hr{R@@mkg*f{@=yUxEFDMwN6@;(V|bx> ziq~9G3-k?>+5sAl+vp+m_E{;H_RQs*kKq(#60*9O6Woy-JG|MBqmmdcV~C%z5nTO@*9O*)!dHCg8Lr+7{jDw;ytyzywS>{ z+#mgU>JirqoD=%j35Hj>s#)p$+4lM-aDC44B^Pu5`CC@ePoh#Q`eQm?8YHRaOSpTk z@e}rmNDf#mtVb55=YS^E`)NQ(nE-r4m1jF1_xVuuT#8vD%^$zqq+v7oN#rbC~o*AEy+Ikqq9 zT2NRI$!4DUot14ABgN2<)z1O$)?x4f38GPK565Wk&Q0BA)z2COAMv7wA|1UB_$K=n zCL)T65&63A8MhaKdm3Xg?#gh$aUHd|Xb6Ec87UxTJDI!`Y3CHNz9-a+leTM)MSXT< z9=mgpn92#^7VJR*-C1o+;@qqe-R1_mS$N#teV&GKw{e?f*2>X@atkWf?h#8KQn?Vi zH=%mZ<_&ZO?SEqW4u3s>W!E2%#d$4CG0a=G59M?ZZ)A!5aP6(HwmFrJ^i#iu*IfRimCO zf=k7nJ@dtC1N3cOeJNA2;&RuSq;<#(wIhb76ED!t`VQz- z3HH2=fpJ^j@9DMAVK`!o%|C|U$-9rh@S-F^rvAcbI!H#$e8}@BF(7xx6i3rIXQ=)3 z3Y`ihir#X3ST2b)v*on8zuSCmVMNmON(+!u1W7vuaERP$rm!Hpedcm)BwwOAKB~%P3l=gG`e|sOl?>4^7Fg?Wkr4Iw)GJhP=Smep@7M|+X67e zbmO}J-p+DY=S`jJc%A3`Dml4>pSJmasvg5wo(+F2hg@!wnZ>u=LxFN*KVEAwDvd%0 zI(9O6Zc{CYEgqKgIIV0ld|UN4PcBfq-DZqWWl}>tG#7C*5)XYY2#S*C)Un35u(-{r z1N&jwzivdTw@{3acLwX~>5=k1i5%FdIL-)_NXHhUh(A#(25{EnGJJ&%yVi0ErO z5f$gr-cnW#K%zSDPvla}uK-os0QUC>5$~!>z@JT5TQe;F+^L>Re#en){Rk! z&@(JVRpB?6sB62`aBwDT23Q;YNWJ%k<1Iu%+rU_`1T@*2E^X&LP1+%M7b0sP!KHcG zwP;>A-u*7JTH9>>0kLHaZc`fGXY{q?1(&by#2}4?solhR*jIY^*Sbj!^8i*cKuLzz zQVrm50htYbx1$ts)NZ=4qmbRq=*O!u*9>45DkPq(a3`(+1>A6Sczg~%2&SI@Ei3EE z?wf{kE-Ou<22huRa(+@a^n>^-iWDotm@Kc4e?EQ%=Y+^~3;L>Ym*yV#1PZ03>6JVZ zKCrlJggw;E5~_ZmrMfH?^<3@Q%+xSXW3-4{8&W*dN3(ZytqfmIPQXFpk9>1ujoK%P z=)yGYfdd_0(2W2cNI)=9lx)*r(a*XwmHh+b-0`mHk*%HG3wuu|C*wz<(O|TW3=Q7 zeOmoD(1dUktY75mC)hxJsY;EO_oK<+A7Uiqx=`J|6t@YRECkv3{6oJ9bd}7zdchpV zFdecgLCXB@9t%3m{XoXQz-BGgTso!e{fXc2-Ur{%T6rziyA}pqU4(8YhuR4|L{9?_ z0$L&f2vLd1#qUsuZ`ljqq5BPjto5!8s5Va&>@jT9JfP-{pZor=qM{;a-Ymd%y<+#4 zg)gUmOY#JPzAO)MTWeIYy z(_Rvn$?(hb)jDr4VBU+@8grb#t{^Y(1+a=%yS|TPNqyjNc^C0O2B2+g11P5kK*BTk z*~3(4`JO$7mv{N~M`MS6RTyM>S~s0ek-}1u^q88V}oKttXB<95ZKac;AnsO@9b3vNX&jvkJ*Rc7^c`~M=>JwH1T2O6w504~y7PmS@AU6V^t5fkKu!8gqI_7D$aqt#yRyAhe7o zG3d5=X=0v^+HrjmoSW!XNCkbbjvm8920W+{^b&PTR5>)K)7i zV!)dBPhJcIu~II;bJ*LhXw3XlP>?ERzs@f^sApyL79^?A6P1Ai!a6}gEAXriRgG&`IdXm()pKW)GRi89dw0tL93y8bDl#*8kCFW__#7s1`&&mz8+HI z!*#dF6H-a9XzY##2GL7GMmC(xyEK|DLqN``4DJTngg!@GK-eG56r0|6$$o6YGb}MW z$zu{o#I3ViyS}g`RNfbQuvIG!Xap{&B8gPF(k;2^No^3?M&226j5x^Vy#fjj%7l}S#+TJgu{W_+pH2Q*-w?@D?v3X>( z77i@)&%eH>`pu$HPf?w2W&h8v{R30V5EG?R?T(cn%K6&z>*^+)qZTe-P4s*Yg$vls zkNz6#1ucarCZ{F5Kju8C{$|CeuAx3Y7N;?`9(SY}A [!NOTE] +> The policy type and ID of the final output policy will be determined based on the type and ID of the **first policy** in the policy list table. For instance, if a legacy policy format policy and a multi-policy format policy are merged together, the output format of the policy will be whichever policy is specified first in the table. For more information on policy formats, visit the [Multiple WDAC Policies page](deploy-multiple-windows-defender-application-control-policies). + +Lastly, select a filepath save location for the final merged policy on disk using the Browse button. Once at least two policies to merge are specified, and the output file location is set, click Next to build the policy. + +![Merging WDAC policies into a final WDAC policy](images/wdac-wizard-merge.png) \ No newline at end of file From bb7869b07535f9201647ead2e0c07eccfefb26c9 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 14 Dec 2020 15:04:37 -0500 Subject: [PATCH 009/206] Updated create-base-policy sub-topic with spelling/grammar suggestions from acrolinx --- .../wdac-wizard-create-base-policy.md | 40 +++++++++---------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md index 0d1d32ff12..f532ee4e59 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md @@ -1,7 +1,7 @@ --- title: Windows Defender Application Control Wizard Base Policy Creation -description: Creating new base appliation control policies with the Microsoft WDAC Wizard. -keywords: allowlisting, blocklisting, security, malware +description: Creating new base application control policies with the Microsoft Windows Defender Application (WDAC) Wizard. +keywords: allow listing, block listing, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy @@ -24,19 +24,19 @@ ms.date: 10/14/2020 - Windows 10 - Windows Server 2016 and above -When creating policies for use with Windows Defender Application Control (WDAC), it is recommended to start from an existing base policy and then add or remove rules to build your own custom policy XML files. For this reason, the WDAC Wizard offers three template policies to start from and customize during the base policy creation workflow. Prerequisite information about application control can be accessed through the [WDAC design guide](windows-defender-application-control-design-guide.md). This page outlines the steps to create a new application control policy from a template, configure the policy options, and the signer and file rules. +When creating policies for use with Windows Defender Application Control (WDAC), it is recommended to start with a template policy and then add or remove rules to suit your application control scenario. For this reason, the WDAC Wizard offers three template policies to start from and customize during the base policy creation workflow. Prerequisite information about application control can be accessed through the [WDAC design guide](windows-defender-application-control-design-guide.md). This page outlines the steps to create a new application control policy from a template, configure the policy options, and the signer and file rules. ## Template Base Policies -Each of the template policies has a unique set of policy allowlist rules which will affect the circle-of-trust and security model of the policy. The following table lists the policies in increasing order of trust and freedom. For instance, the Default Windows mode policy has fewer allowed signer rules, compared to the Signed and Reputable mode, and will offer a more selective circle-of-trust, less flexibility and subquently higher security. +Each of the template policies has a unique set of policy allow list rules that will affect the circle-of-trust and security model of the policy. The following table lists the policies in increasing order of trust and freedom. For instance, the Default Windows mode policy trusts fewer application publishers and signers than the Signed and Reputable mode policy. The Default Windows policy will have a smaller circle-of-trust with better security than the Signed and Reputable policy, but at the expense of compatibility. | **Template Base Policy** | **Description** | |---------------------------------|-------------------------------------------------------------------| -| **Default Windows Mode** | Default Windows mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive and Microsoft Teams
    • Third party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
    | -| **Allow Microsoft Mode** | Allow mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive and Microsoft Teams
    • Third party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
    • *All Microsoft-signed software*
    | -| **Signed and Reputable Mode** | Signed and Reputable mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive and Microsoft Teams
    • Third party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
    • All Microsoft-signed software
    • *Files with good reputation per [Microsoft Defender's Intelligent Security Graph techology](use-windows-defender-application-control-with-intelligent-security-graph)*
    | +| **Default Windows Mode** | Default Windows mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
    | +| **Allow Microsoft Mode** | Allow mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
    • *All Microsoft-signed software*
    | +| **Signed and Reputable Mode** | Signed and Reputable mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
    • All Microsoft-signed software
    • *Files with good reputation per [Microsoft Defender's Intelligent Security Graph technology](use-windows-defender-application-control-with-intelligent-security-graph)*
    | *Italized content denotes the changes in the current policy with respect to the policy prior.* @@ -47,18 +47,18 @@ Once the base template is selected, give the policy a name and choose where to s ## Configuring Policy Rules -Upon page launch, policy rules will be automatically enabled/disabled depending on the chosen template from the previous page. Choose to enable or disable the desired policy rule options by pressing the slider button next to the policy rule titles. Hovering the mouse over the policy rule title will display a short description of the rule at the bottom of the page. +Upon page launch, policy rules will be automatically enabled/disabled depending on the chosen template from the previous page. Choose to enable or disable the desired policy rule options by pressing the slider button next to the policy rule titles. A short description of each rule will appear at the bottom of the page when the mouse hovers over the rule title. ### Policy Rules Description -A description of the policy rules, beginning with the left-most column are provided below. +A description of each policy rule, beginning with the left-most column, is provided below. | Rule option | Description | |------------ | ----------- | | **Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all WDAC policies. Setting this rule option allows the F8 menu to appear to physically present users. | | **Allow Supplemental Policies** | Use this option on a base policy to allow supplemental policies to expand it. | | **Disable Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is only supported with the Windows 10 May 2019 Update (1903) and higher. Using it on earlier versions of Windows 10 is not supported and may have unintended results. | -|**[Hypervisor-protected code integrity](https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. This provides stronger protections against kernel malware.| +|**[Hypervisor-protected code integrity (HVCI)](https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. HVCI provides stronger protections against kernel malware.| | **Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | | **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, that has been defined as a managed installer. | | **Require WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows 10–compatible driver must be WHQL certified. | @@ -68,15 +68,15 @@ A description of the policy rules, beginning with the left-most column are provi ### Advanced Policy Rules Description -Selecting the **+ Advanced Options** label will show another column of policy rules; advanced policy rules. A description of the policy rules are provided below. +Selecting the **+ Advanced Options** label will show another column of policy rules; advanced policy rules. A description of each policy rule is provided below. | Rule option | Description | |------------ | ----------- | | **Boot Audit on Failure** | Used when the WDAC policy is in enforcement mode. When a driver fails during startup, the WDAC policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. | -| **Disable Flight Signing** | If enabled, WDAC policies will not trust flightroot-signed binaries. This would be used in the scenario in which organizations only want to run released binaries, not flighted builds. | +| **Disable Flight Signing** | If enabled, WDAC policies will not trust flightroot-signed binaries. This would be used in the scenario in which organizations only want to run released binaries, not flight/preview-signed builds. | | **Disable Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that’s only writable by an administrator) for any FileRule that allows a file based on FilePath. | -| **Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically-loaded libraries. | -| **Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically re-validate the reputation for files that were authorized by the ISG.| +| **Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically loaded libraries (DLLs). | +| **Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically revalidate the reputation for files that were authorized by the ISG.| | **Require EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All Windows 10 and later drivers will meet this requirement. | @@ -88,29 +88,29 @@ Selecting the **+ Advanced Options** label will show another column of policy ru ## Creating custom file rules -File rules in an application control policy will specify the level at which appiations will be identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** will open the custom file rule conditions panel to create and customize targeted file rules for your policy. The Wizard supports 4 types of file rules: +File rules in an application control policy will specify the level at which applications will be identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** will open the custom file rule conditions panel to create custom file rules for your policy. The Wizard supports four types of file rules: ### Publisher Rules -The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specifity of the rule. The table below shows the relationship between the slider placement, the corresponding WDAC rule level and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. +The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specificity of the rule. The table below shows the relationship between the slider placement, the corresponding WDAC rule level and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. | Rule Condition | WDAC Rule Level | Description | |------------ | ----------- | ----------- | | **Issuing CA** | PCACertificate | Highest available certificate is added to the signers. This is typically the PCA certificate, one level below the root certificate. Any file signed by this certificate will be affected. | | **Publisher** | Publisher | This rule is a combination of the PCACertificate rule and the common name (CN) of the leaf certificate. Any file signed by a major CA but with a leaf from a specific company, for example a device driver corp, is affected. | -| **File version** | SignedVersion | This rule is a combination of PCACertificate, Publisher and a version number. Anything from the specified publisher with a version at or above the one specified is affected. | -| **File name** | FilePublisher | Most specific. Combination of the file name, publisher and PCA certificate as well as a minimum version number. Files from the publisher with the specified name and greater or equal to the specified version are affected. | +| **File version** | SignedVersion | This rule is a combination of PCACertificate, publisher, and a version number. Anything from the specified publisher with a version at or above the one specified is affected. | +| **File name** | FilePublisher | Most specific. Combination of the file name, publisher, and PCA certificate as well as a minimum version number. Files from the publisher with the specified name and greater or equal to the specified version are affected. | ![Custom filepublisher file rule creation](images/wdac-wizard-custom-publisher-rule.png) ### Filepath Rules -Filepath rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. To create a filepath rule, simply select the file using the *Browse* button. +Filepath rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. To create a filepath rule, select the file using the *Browse* button. ### File Attribute Rules -The Wizard supports the creation of [file name rules](select-types-of-rules-to-create#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (eg. DLLs) may all share the same product name, for instance. This allows users to easily create targeted policies based on the Product Name filename rule level. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. +The Wizard supports the creation of [file name rules](select-types-of-rules-to-create#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name parameter. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. | Rule level | Description | |------------ | ----------- | From f039be808ff15bafce5f18b910d642bc1c21fae8 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 14 Dec 2020 15:17:46 -0500 Subject: [PATCH 010/206] Updated wdac-wizard.md to fix spelling and grammar per Acrolinx scorecard --- .../wdac-wizard.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md index c21368ab72..89403445f6 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md @@ -1,6 +1,6 @@ --- title: Windows Defender Application Control Wizard -description: Microsoft WDAC Wizard allows users to create, edit and merge application control policies in a simple to use Windows application. +description: Microsoft Defender Application Control Wizard (WDAC) Wizard allows users to create, edit, and merge application control policies in a simple to use Windows application. keywords: allowlisting, blocklisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 @@ -25,11 +25,11 @@ ms.date: 10/14/2020 - Windows 10 - Windows Server 2016 and above -This topic describes the supported scenarios for the Windows Defender Application Control (WDAC) policy Wizard. The Wizard was built to provide security architects, security administrators, and system administrators with a more user-friendly means to create, edit and merge application control policies using a GUI desktop application. The Wizard uses the [ConfigCI PowerShell Cmdlets](https://docs.microsoft.com/en-us/powershell/module/configci/?view=win10-ps) in the background so the output policy of the Wizard and PowerShell cmdlets are identical. +This article describes the supported scenarios for the Windows Defender Application Control (WDAC) policy Wizard. The Wizard was built to provide security architects, security and system administrators with a more user-friendly means to create, edit, and merge WDAC policies. The Wizard desktop application uses the [ConfigCI PowerShell Cmdlets](https://docs.microsoft.com/en-us/powershell/module/configci/?view=win10-ps) in the background so the output policy of the Wizard and PowerShell cmdlets is identical. ## Downloading the application -The latest version of the application is available for download from the official [Microsoft WDAC Wizard installer website](https://bit.ly/3koHwYs) as an MSIX packaged application. Additionally, the source code for the Wizard is also available as part of Microsoft's Open Source Software offerings on Github at the [WDAC Wizard Repo](https://github.com/MicrosoftDocs/WDAC-Toolkit). +The WDAC Wizard can be downloaded from the official [Wizard installer website](https://bit.ly/3koHwYs) as an MSIX packaged application. The Wizard's source code is available as part of Microsoft's Open Source Software offerings on GitHub at the [WDAC Wizard Repo](https://github.com/MicrosoftDocs/WDAC-Toolkit). **Supported Clients** @@ -38,16 +38,16 @@ As the WDAC Wizard uses the cmdlets in the background, the Wizard is functional - Windows builds 1909+ - For pre-1909 builds, the Enterprise SKU of Windows is installed -If neither requirement is satisfied, the Wizard will not allow for creating, editing or merging policies. +If neither requirement is satisfied, the Wizard will throw an error as the cmdlets are not available. ## In this section | Topic | Description | | - | - | -| [Creating a new base policy](wdac-wizard-create-base-policy.md) | This topic describes the how to create a new base policy using one of the supplied policy templates. | -| [Creating a new supplemental policy](wdac-wizard-create-supplemental-policy.md) | This topic describes the steps necessary to create a supplemental policy, from one of the supplied templates, for an existing base policy. | -| [Editing a base or supplemental policy](wdac-wizard-edit-policy.md) | This topic demonstrates how to modify an existing policy and the Wizard's editing capabilities. | -| [Merging policies](wdac-wizard-merging-policies.md) | This topic describes how to merge policies into a single application control policy. | -| [Deploying policies from the Wizard](wdac-wizard-deploying-policies.md) | This topic describes how to deploy application control policies onto target devices. | +| [Creating a new base policy](wdac-wizard-create-base-policy.md) | This article describes how to create a new base policy using one of the supplied policy templates. | +| [Creating a new supplemental policy](wdac-wizard-create-supplemental-policy.md) | This article describes the steps necessary to create a supplemental policy, from one of the supplied templates, for an existing base policy. | +| [Editing a base or supplemental policy](wdac-wizard-edit-policy.md) | This article demonstrates how to modify an existing policy and the Wizard's editing capabilities. | +| [Merging policies](wdac-wizard-merging-policies.md) | This article describes how to merge policies into a single application control policy. | +| [Deploying policies from the Wizard](wdac-wizard-deploying-policies.md) | This article describes how to deploy application control policies onto target devices. | From c96a8ddee724d98fb665ca7ca9c8e62994dca78b Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 14 Dec 2020 15:35:18 -0500 Subject: [PATCH 011/206] updated wdac-wizard-create-supplemental-policy.md for grammar/spelling --- .../wdac-wizard-create-supplemental-policy.md | 35 +++++++++---------- 1 file changed, 17 insertions(+), 18 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md index 77ebccf335..6dc20f1ffe 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md @@ -30,27 +30,26 @@ Prerequisite information about application control can be accessed through the [ ## Expanding a Base Policy -Once the Policy Creator > Supplemental Policy type is chosen, a policy name and file location dialog will appear to name and save the supplemental policy. The next step requires selecting a base policy to expand. To expand a base policy, the base must allow supplemental policies. The WDAC Wizard will verify whether the base poliy allows supplementals and will show either of the following confirmations. +Once the Supplemental Policy type is chosen on the New Policy page, policy name and file dialog fields can be used to name and save the supplemental policy. The next step requires selecting a base policy to expand. To expand a base policy, the base must allow supplemental policies. The WDAC Wizard will verify if the base policy allows supplementals and will show the following confirmation. ![Base policy allows supplemental policies](images/wdac-wizard-supplemental-expandable.png) -![Base policy does not allow supplemental policies](images/wdac-wizard-supplemental-not-expandable.png) If the base policy is not configured for supplemental policies, first edit the base policy to allow supplementals using the [WDAC Wizard edit workflow](edac-wizard-editing-policy.md). ## Configuring Policy Rules -Upon page launch, policy rules will be automatically enabled/disabled depending on the chosen template from the previous page. Choose to enable or disable the desired policy rule options by pressing the slider button next to the policy rule titles. Hovering the mouse over the policy rule title will display a short description of the rule at the bottom of the page. +Upon page launch, policy rules will be automatically enabled/disabled depending on the chosen template from the previous page. Choose to enable or disable the desired policy rule options by pressing the slider button next to the policy rule titles. A short description of the rule will be shown at the bottom of the page when the cursor is placed on the rule title. ### Policy Rules Description -A description of the policy rules, beginning with the left-most column are provided below. +A description of each policy rule, beginning with the left-most column, is provided below. | Rule option | Description | |------------ | ----------- | | **Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all WDAC policies. Setting this rule option allows the F8 menu to appear to physically present users. | | **Allow Supplemental Policies** | Use this option on a base policy to allow supplemental policies to expand it. | | **Disable Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is only supported with the Windows 10 May 2019 Update (1903) and higher. Using it on earlier versions of Windows 10 is not supported and may have unintended results. | -|**[Hypervisor-protected code integrity](https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. This provides stronger protections against kernel malware.| +|**[Hypervisor-protected code integrity (HVCI)](https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. HVCI provides stronger protections against kernel malware.| | **Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | | **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, that has been defined as a managed installer. | | **Require WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows 10–compatible driver must be WHQL certified. | @@ -60,15 +59,15 @@ A description of the policy rules, beginning with the left-most column are provi ### Advanced Policy Rules Description -Selecting the **+ Advanced Options** label will show another column of policy rules; advanced policy rules. A description of the policy rules are provided below. +Selecting the **+ Advanced Options** label will show another column of policy rules; advanced policy rules. A description of each policy rule is provided below. | Rule option | Description | |------------ | ----------- | | **Boot Audit on Failure** | Used when the WDAC policy is in enforcement mode. When a driver fails during startup, the WDAC policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. | -| **Disable Flight Signing** | If enabled, WDAC policies will not trust flightroot-signed binaries. This would be used in the scenario in which organizations only want to run released binaries, not flighted builds. | +| **Disable Flight Signing** | If enabled, WDAC policies will not trust flightroot-signed binaries. This setting should be used in scenarios where organizations only want to run production binaries, not flight/preivew-signed builds. | | **Disable Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that’s only writable by an administrator) for any FileRule that allows a file based on FilePath. | -| **Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically-loaded libraries. | -| **Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically re-validate the reputation for files that were authorized by the ISG.| +| **Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically loaded libraries. | +| **Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically revalidate the reputation for files that were authorized by the ISG.| | **Require EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All Windows 10 and later drivers will meet this requirement. | @@ -80,17 +79,17 @@ Selecting the **+ Advanced Options** label will show another column of policy ru ## Creating custom file rules -File rules in an application control policy will specify the level at which appiations will be identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** will open the custom file rule conditions panel to create and customize targeted file rules for your policy. The Wizard supports 4 types of file rules: +File rules in an application control policy will specify the level at which applications will be identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** will open the custom file rule conditions panel to create and customize targeted file rules for your policy. The Wizard supports four types of file rules: ### Publisher Rules -The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specifity of the rule. The table below shows the relationship between the slider placement, the corresponding WDAC rule level and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. +The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specificity of the rule. The table below shows the relationship between the slider placement, the corresponding WDAC rule level, and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. | Rule Condition | WDAC Rule Level | Description | |------------ | ----------- | ----------- | -| **Issuing CA** | PCACertificate | Highest available certificate is added to the signers. This is typically the PCA certificate, one level below the root certificate. Any file signed by this certificate will be affected. | -| **Publisher** | Publisher | This rule is a combination of the PCACertificate rule and the common name (CN) of the leaf certificate. Any file signed by a major CA but with a leaf from a specific company, for example a device driver corp, is affected. | -| **File version** | SignedVersion | This rule is a combination of PCACertificate, Publisher and a version number. Anything from the specified publisher with a version at or above the one specified is affected. | +| **Issuing CA** | PCACertificate | Highest available certificate is added to the signers. This certificate is typically the PCA certificate, one level below the root certificate. Any file signed by this certificate will be affected. | +| **Publisher** | Publisher | This rule is a combination of the PCACertificate rule and the common name (CN) of the leaf certificate. Any file signed by a major CA but with a leaf from a specific company, for example a device driver publisher, is affected. | +| **File version** | SignedVersion | This rule is a combination of the PCACertificate and Publisher rule, and a version number. Anything from the specified publisher with a version at or above the one specified is affected. | | **File name** | FilePublisher | Most specific. Combination of the file name, publisher and PCA certificate as well as a minimum version number. Files from the publisher with the specified name and greater or equal to the specified version are affected. | @@ -98,11 +97,11 @@ The Publisher file rule type uses properties in the code signing certificate cha ### Filepath Rules -Filepath rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. To create a filepath rule, simply select the file using the *Browse* button. +Filepath rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. To create a filepath rule, select the file using the *Browse* button. ### File Attribute Rules -The Wizard supports the creation of [file name rules](select-types-of-rules-to-create#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (eg. DLLs) may all share the same product name, for instance. This allows users to easily create targeted policies based on the Product Name filename rule level. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. +The Wizard supports the creation of [file name rules](select-types-of-rules-to-create#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. | Rule level | Description | |------------ | ----------- | @@ -121,8 +120,8 @@ Lastly, the Wizard supports creating file rules using the hash of the file. Alth #### Deleting Signing Rules -The policy signing rules list table on the left of the page will document the allow and deny rules in the template, as well as any custom rules you create. Template signing rules and custom rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. you will be prompted for additional confirmation. Select `Yes` to remove the rule from the policy and the rules table. +The table on the left of the page will document the allow and deny rules in the template, as well as any custom rules you create. Rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. you will be prompted for additional confirmation. Select `Yes` to remove the rule from the policy and the rules table. ## Up next -- [Editing a WDAC policy using the Wizard](wdac-wizard-editing-policy.md) \ No newline at end of file +- [Editing a WDAC policy using the Wizard](wdac-wizard-editing-policy.md) From c70c8ee8812de16b0c4c8b9f52202ebfad5083d2 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 14 Dec 2020 15:49:59 -0500 Subject: [PATCH 012/206] fixed grammar/spelling in wdac-wizard-editing-policy.md --- .../wdac-wizard-editing-policy.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md index d3ef342f31..ec71f80aba 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md @@ -18,13 +18,13 @@ ms.topic: conceptual ms.date: 10/14/2020 --- -# Editing exisiting base and supplemental WDAC policies with the Wizard +# Editing existing base and supplemental WDAC policies with the Wizard **Applies to** - Windows 10 - Windows Server 2016 and above -The WDAC Wizard makes editing and viewing base and supplemental WDAC policies much easier than by hand or using the PowerShell Cmdlets. The Wizard currently supports the following editing capbilities: +The WDAC Wizard makes editing and viewing WDAC policies easier than the PowerShell cmdlets or manually. The Wizard currently supports the following editing capabilities:
    • [Configuring policy rules](#Configuring-Policy-Rules)
    • [Adding new allow or block file rules to existing policies](#Adding-File-Rules)
      • @@ -34,21 +34,21 @@ The WDAC Wizard makes editing and viewing base and supplemental WDAC policies mu # Configuring Policy Rules -The `Policy Rules` page will load with the in-edit policy rules configured per the set rules. Selecting the `+ Advanced Options` button will reveal the advanced policy rule options panel. This grouping of rules contains additional policy rule options which are less common to the majority of users. To edit any of the rules, flip the corresponding policy rule state. For instance, to disable Audit Mode and enable Enforcement Mode in the figure below, the button beside the `Audit Mode` label needs only to be pressed. Once the policy rules are configured, select the Next button to continue the next stage of editing: [Adding File Rules](#Adding-File-Rules). +The `Policy Rules` page will load with the in-edit policy rules configured per the set rules. Selecting the `+ Advanced Options` button will reveal the advanced policy rule options panel. This grouping of rules contains additional policy rule options that are less common to the majority of users. To edit any of the rules, flip the corresponding policy rule state. For instance, to disable Audit Mode and enable Enforcement Mode in the figure below, the button beside the `Audit Mode` label needs only to be pressed. Once the policy rules are configured, select the Next button to continue the next stage of editing: [Adding File Rules](#Adding-File-Rules). ![Configuring the policy rules](images/wdac-wizard-edit-policy-rules.png) -Hovering the mouse over the policy rule names will display a short description of the ruleat the bottom of the page.For a complete list of the policy rules and their capabilities see the [Windows Defender Application Control policy rules table](select-types-of-rules-to-create.md#windows-defender-application-control-policy-rules). +A description of the policy rule is shown at the bottom of the page when the cursor is placed over the rule title. For a complete list of the policy rules and their capabilities, see the [Windows Defender Application Control policy rules table](select-types-of-rules-to-create.md#windows-defender-application-control-policy-rules). ## Adding File Rules -Previously, to add rules to an existing policy, users would be required to create a new policy and merge it with their existing policy, or edit the policy by hand. The WDAC Wizard allows users to add rules to their exising policy seamlessly. +The WDAC Wizard allows users to add rules to their existing policy seamlessly. Previously, this would have involved creating a new policy with the new rules and merging it with the existing policy. Selecting the `+ Custom Rules` button will open the Custom Rules panel. For more information on creating new policy file rules, see the guidelines provided in the [creating policy file rules section](wdac-wizard-create-base-policy.md#Creating-custom-file-rules). ## Removing File Rules -The WDAC Wizard makes deleting file rules from an existing policy quick and easy. To remove any type of file rule: publisher rule, path rule, filename rule or a hash rule, simply click on the rule in the `Policy Signing Rules List` table on the lefthand side of the page. Selecting the rule will highlight the entire row. Once the row is highlighted, select the remove icon underneath the table. The Wizard will prompt for user confirmation before removing the file rule. Once removed, the rule will no longer appear in the policy or the table. +The WDAC Wizard makes deleting file rules from an existing policy quick and easy. To remove any type of file rule: publisher rule, path rule, filename rule, or a hash rule, select the rule in the `Policy Signing Rules List` table on the left-hand side of the page. Selecting the rule will highlight the entire row. Once the row is highlighted, select the remove icon underneath the table. The Wizard will prompt for user confirmation before removing the file rule. Once removed, the rule will no longer appear in the policy or the table. ![Removing file rule from policy during edit](image/wdac-wizard-edit-remove-file-rule.png) @@ -66,8 +66,8 @@ The WDAC Wizard makes deleting file rules from an existing policy quick and easy ### Policy Creation -Once the WDAC Wizard finalizes creation of your edited policy, the new policy will be written to the same file path and name as the in-edit policy with the new version appended to the end of the file name. For instance, if the in-edit policy is saved at MyDocuments\BasePolicy.xml, after edit, the new policy will be saved at MyDocuments\BasePolicy_v10.0.0.1.xml. +Once the policy is created, the new policy will be written to the same path as the in-edit policy. The new policy file name will have the policy version appended to the end of the file name. For instance, if the in-edit policy is saved at MyDocuments\BasePolicy.xml, after edit, the new policy will be saved at MyDocuments\BasePolicy_v10.0.0.1.xml. ## Up next -- [Merging WDAC policies using the Wizard](wdac-wizard-merging-policies.md) \ No newline at end of file +- [Merging WDAC policies using the Wizard](wdac-wizard-merging-policies.md) From 15ef5a5dcb2e6dafff3de6cb9a0624fe81d356e1 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 14 Dec 2020 15:56:08 -0500 Subject: [PATCH 013/206] fixed grammar/spelling in merging policies article --- .../wdac-wizard-merging-policies.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md index 53f2c6162d..eca772e093 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md @@ -20,13 +20,13 @@ ms.date: 10/14/2020 # Merging existing policies with the WDAC Wizard -Beginning in Windows 10 version 1903, WDAC supports multiple policies. Before version 1903, however, Windows 10 could only have one WDAC policy. Consquently, users were required to merge multiple WDAC policies into one. The WDAC Wizard has a simple to use user interface to allow users to merge multiple WDAC policies. The Wizard can support up to 15 policy files as input during the merge workflow. +Beginning in Windows 10 version 1903, WDAC supports multiple policies. Before version 1903, however, Windows 10 could only have one WDAC policy. Consequently, users were required to merge multiple WDAC policies into one. The WDAC Wizard has a simple to use user interface to allow users to merge multiple WDAC policies. The Wizard can support up to 15 policy files as input during the merge workflow. -Simply select the policies you wish to merge into one policy using the `+ Add Policy` button under the table. Once added, policies will be enumerated within the table. To remove a policy from the table, in the case of accidental addition, highlight the policy row and click the `- Remove Policy` button. Confirmation will be required before the policy is withdrawn from the table. +Select the policies you wish to merge into one policy using the `+ Add Policy` button under the table. Once added, policies will be enumerated within the table. To remove a policy from the table, if accidentally added, highlight the policy row and select the `- Remove Policy` button. Confirmation will be required before the policy is withdrawn from the table. > [!NOTE] > The policy type and ID of the final output policy will be determined based on the type and ID of the **first policy** in the policy list table. For instance, if a legacy policy format policy and a multi-policy format policy are merged together, the output format of the policy will be whichever policy is specified first in the table. For more information on policy formats, visit the [Multiple WDAC Policies page](deploy-multiple-windows-defender-application-control-policies). -Lastly, select a filepath save location for the final merged policy on disk using the Browse button. Once at least two policies to merge are specified, and the output file location is set, click Next to build the policy. +Lastly, select a filepath save location for the final merged policy using the `Browse` button. If a minimum of two policies are selected, and the save location is specified, select the `Next` button to build the policy. -![Merging WDAC policies into a final WDAC policy](images/wdac-wizard-merge.png) \ No newline at end of file +![Merging WDAC policies into a final WDAC policy](images/wdac-wizard-merge.png) From cb480eefb414fd2b68e0478d268aa73e21770c97 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 14 Dec 2020 17:40:26 -0500 Subject: [PATCH 014/206] Fixed broken links for edit policy article and deploying policy articles. --- .../windows-defender-application-control/wdac-wizard.md | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md index 89403445f6..4e765e5339 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md @@ -25,7 +25,7 @@ ms.date: 10/14/2020 - Windows 10 - Windows Server 2016 and above -This article describes the supported scenarios for the Windows Defender Application Control (WDAC) policy Wizard. The Wizard was built to provide security architects, security and system administrators with a more user-friendly means to create, edit, and merge WDAC policies. The Wizard desktop application uses the [ConfigCI PowerShell Cmdlets](https://docs.microsoft.com/en-us/powershell/module/configci/?view=win10-ps) in the background so the output policy of the Wizard and PowerShell cmdlets is identical. +This article describes the supported scenarios for the Windows Defender Application Control (WDAC) policy Wizard. The Wizard was built to provide security architects, security and system administrators with a more user-friendly means to create, edit, and merge WDAC policies. The Wizard desktop application uses the [ConfigCI PowerShell Cmdlets](https://docs.microsoft.com/powershell/module/configci/?view=win10-ps) in the background so the output policy of the Wizard and PowerShell cmdlets is identical. ## Downloading the application @@ -46,8 +46,5 @@ If neither requirement is satisfied, the Wizard will throw an error as the cmdle | - | - | | [Creating a new base policy](wdac-wizard-create-base-policy.md) | This article describes how to create a new base policy using one of the supplied policy templates. | | [Creating a new supplemental policy](wdac-wizard-create-supplemental-policy.md) | This article describes the steps necessary to create a supplemental policy, from one of the supplied templates, for an existing base policy. | -| [Editing a base or supplemental policy](wdac-wizard-edit-policy.md) | This article demonstrates how to modify an existing policy and the Wizard's editing capabilities. | +| [Editing a base or supplemental policy](wdac-wizard-editing-policy.md) | This article demonstrates how to modify an existing policy and the Wizard's editing capabilities. | | [Merging policies](wdac-wizard-merging-policies.md) | This article describes how to merge policies into a single application control policy. | -| [Deploying policies from the Wizard](wdac-wizard-deploying-policies.md) | This article describes how to deploy application control policies onto target devices. | - - From bbb3142a8b02f6e0e02df4dc8573202e581bb2d9 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 14 Dec 2020 17:43:08 -0500 Subject: [PATCH 015/206] Fixed broken Multiple WDAC Policies page link in WDAC Wizard merge policy article --- .../wdac-wizard-merging-policies.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md index eca772e093..1b7d604a49 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md @@ -25,7 +25,7 @@ Beginning in Windows 10 version 1903, WDAC supports multiple policies. Before ve Select the policies you wish to merge into one policy using the `+ Add Policy` button under the table. Once added, policies will be enumerated within the table. To remove a policy from the table, if accidentally added, highlight the policy row and select the `- Remove Policy` button. Confirmation will be required before the policy is withdrawn from the table. > [!NOTE] -> The policy type and ID of the final output policy will be determined based on the type and ID of the **first policy** in the policy list table. For instance, if a legacy policy format policy and a multi-policy format policy are merged together, the output format of the policy will be whichever policy is specified first in the table. For more information on policy formats, visit the [Multiple WDAC Policies page](deploy-multiple-windows-defender-application-control-policies). +> The policy type and ID of the final output policy will be determined based on the type and ID of the **first policy** in the policy list table. For instance, if a legacy policy format policy and a multi-policy format policy are merged together, the output format of the policy will be whichever policy is specified first in the table. For more information on policy formats, visit the [Multiple WDAC Policies page](deploy-multiple-windows-defender-application-control-policies.md). Lastly, select a filepath save location for the final merged policy using the `Browse` button. If a minimum of two policies are selected, and the save location is specified, select the `Next` button to build the policy. From 4dad3db2b6a37a505eb22ddb2d77aac2bceb63ac Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 14 Dec 2020 17:51:25 -0500 Subject: [PATCH 016/206] Fixed broken image link and page header references --- .../wdac-wizard-editing-policy.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md index ec71f80aba..a239d415ec 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md @@ -1,5 +1,5 @@ --- -title: Windows Defender Application Control Wizard Base Policy Creation +title: Editing Windows Defender Application Control Policies with the Wizard description: Editing existing base and supplemental policies with the Microsoft WDAC Wizard. keywords: allowlisting, blocklisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -32,9 +32,9 @@ The WDAC Wizard makes editing and viewing WDAC policies easier than the PowerShe
    -# Configuring Policy Rules +## Configuring Policy Rules -The `Policy Rules` page will load with the in-edit policy rules configured per the set rules. Selecting the `+ Advanced Options` button will reveal the advanced policy rule options panel. This grouping of rules contains additional policy rule options that are less common to the majority of users. To edit any of the rules, flip the corresponding policy rule state. For instance, to disable Audit Mode and enable Enforcement Mode in the figure below, the button beside the `Audit Mode` label needs only to be pressed. Once the policy rules are configured, select the Next button to continue the next stage of editing: [Adding File Rules](#Adding-File-Rules). +The `Policy Rules` page will load with the in-edit policy rules configured per the set rules. Selecting the `+ Advanced Options` button will reveal the advanced policy rule options panel. This grouping of rules contains additional policy rule options that are less common to the majority of users. To edit any of the rules, flip the corresponding policy rule state. For instance, to disable Audit Mode and enable Enforcement Mode in the figure below, the button beside the `Audit Mode` label needs only to be pressed. Once the policy rules are configured, select the Next button to continue the next stage of editing: [Adding File Rules](#adding-file-rules). ![Configuring the policy rules](images/wdac-wizard-edit-policy-rules.png) @@ -44,13 +44,13 @@ A description of the policy rule is shown at the bottom of the page when the cur The WDAC Wizard allows users to add rules to their existing policy seamlessly. Previously, this would have involved creating a new policy with the new rules and merging it with the existing policy. -Selecting the `+ Custom Rules` button will open the Custom Rules panel. For more information on creating new policy file rules, see the guidelines provided in the [creating policy file rules section](wdac-wizard-create-base-policy.md#Creating-custom-file-rules). +Selecting the `+ Custom Rules` button will open the Custom Rules panel. For more information on creating new policy file rules, see the guidelines provided in the [creating policy file rules section](wdac-wizard-create-base-policy.md#creating-custom-file-rules). ## Removing File Rules The WDAC Wizard makes deleting file rules from an existing policy quick and easy. To remove any type of file rule: publisher rule, path rule, filename rule, or a hash rule, select the rule in the `Policy Signing Rules List` table on the left-hand side of the page. Selecting the rule will highlight the entire row. Once the row is highlighted, select the remove icon underneath the table. The Wizard will prompt for user confirmation before removing the file rule. Once removed, the rule will no longer appear in the policy or the table. -![Removing file rule from policy during edit](image/wdac-wizard-edit-remove-file-rule.png) +![Removing file rule from policy during edit](images/wdac-wizard-edit-remove-file-rule.png) **Note:** removing a publisher rule will also remove the associated File Attribute rules. For instance, in the xml block below, removing ID_SIGNER_CONTOSO_PUBLISHER would also remove the rules ID_FILEATTRIB_LOB_APP_1 and ID_FILEATTRIB_LOB_APP_2. From 70d27f25c9e3799da866eb66563bb3ce73a6ebf9 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 14 Dec 2020 17:55:11 -0500 Subject: [PATCH 017/206] Fixed broken link to select-types-of-rules-to-create.md#windows-defender-application-control-filename-rules and hardcoded locale (en-us) link in HVCI article --- .../wdac-wizard-create-supplemental-policy.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md index 6dc20f1ffe..4383ca390b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md @@ -34,7 +34,7 @@ Once the Supplemental Policy type is chosen on the New Policy page, policy name ![Base policy allows supplemental policies](images/wdac-wizard-supplemental-expandable.png) -If the base policy is not configured for supplemental policies, first edit the base policy to allow supplementals using the [WDAC Wizard edit workflow](edac-wizard-editing-policy.md). +If the base policy is not configured for supplemental policies, first edit the base policy to allow supplementals using the [WDAC Wizard edit workflow](wdac-wizard-editing-policy.md). ## Configuring Policy Rules @@ -49,7 +49,7 @@ A description of each policy rule, beginning with the left-most column, is provi | **Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all WDAC policies. Setting this rule option allows the F8 menu to appear to physically present users. | | **Allow Supplemental Policies** | Use this option on a base policy to allow supplemental policies to expand it. | | **Disable Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is only supported with the Windows 10 May 2019 Update (1903) and higher. Using it on earlier versions of Windows 10 is not supported and may have unintended results. | -|**[Hypervisor-protected code integrity (HVCI)](https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. HVCI provides stronger protections against kernel malware.| +|**[Hypervisor-protected code integrity (HVCI)](https://docs.microsoft.com/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. HVCI provides stronger protections against kernel malware.| | **Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | | **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, that has been defined as a managed installer. | | **Require WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows 10–compatible driver must be WHQL certified. | @@ -101,7 +101,7 @@ Filepath rules do not provide the same security guarantees that explicit signer ### File Attribute Rules -The Wizard supports the creation of [file name rules](select-types-of-rules-to-create#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. +The Wizard supports the creation of [file name rules](select-types-of-rules-to-create.md#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. | Rule level | Description | |------------ | ----------- | From 1a31685da0367b6b2f3866ecebfb5b17f321ea47 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 14 Dec 2020 18:00:10 -0500 Subject: [PATCH 018/206] Fixed more hardcoded locales by removing "en-us" from article links. Also fixed references to the wdac official docs (use-windows-defender-application-control-with-intelligent-security-graph missing .md file ext) --- .../wdac-wizard-create-base-policy.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md index f532ee4e59..d9afb2c2a1 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md @@ -34,9 +34,9 @@ Each of the template policies has a unique set of policy allow list rules that w | **Template Base Policy** | **Description** | |---------------------------------|-------------------------------------------------------------------| -| **Default Windows Mode** | Default Windows mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
    | -| **Allow Microsoft Mode** | Allow mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
    • *All Microsoft-signed software*
    | -| **Signed and Reputable Mode** | Signed and Reputable mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
    • All Microsoft-signed software
    • *Files with good reputation per [Microsoft Defender's Intelligent Security Graph technology](use-windows-defender-application-control-with-intelligent-security-graph)*
    | +| **Default Windows Mode** | Default Windows mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](https://docs.microsoft.com/windows-hardware/drivers/install/whql-release-signature)
    | +| **Allow Microsoft Mode** | Allow mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](https://docs.microsoft.com/windows-hardware/drivers/install/whql-release-signature)
    • *All Microsoft-signed software*
    | +| **Signed and Reputable Mode** | Signed and Reputable mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](https://docs.microsoft.com/windows-hardware/drivers/install/whql-release-signature)
    • All Microsoft-signed software
    • *Files with good reputation per [Microsoft Defender's Intelligent Security Graph technology](use-windows-defender-application-control-with-intelligent-security-graph.md)*
    | *Italized content denotes the changes in the current policy with respect to the policy prior.* @@ -58,7 +58,7 @@ A description of each policy rule, beginning with the left-most column, is provi | **Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all WDAC policies. Setting this rule option allows the F8 menu to appear to physically present users. | | **Allow Supplemental Policies** | Use this option on a base policy to allow supplemental policies to expand it. | | **Disable Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is only supported with the Windows 10 May 2019 Update (1903) and higher. Using it on earlier versions of Windows 10 is not supported and may have unintended results. | -|**[Hypervisor-protected code integrity (HVCI)](https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. HVCI provides stronger protections against kernel malware.| +|**[Hypervisor-protected code integrity (HVCI)](https://docs.microsoft.com/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. HVCI provides stronger protections against kernel malware.| | **Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | | **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, that has been defined as a managed installer. | | **Require WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows 10–compatible driver must be WHQL certified. | @@ -110,7 +110,7 @@ Filepath rules do not provide the same security guarantees that explicit signer ### File Attribute Rules -The Wizard supports the creation of [file name rules](select-types-of-rules-to-create#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name parameter. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. +The Wizard supports the creation of [file name rules](select-types-of-rules-to-create.md#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name parameter. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. | Rule level | Description | |------------ | ----------- | From badb28bbd4d401364027aecd06f0c499bde05cfe Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Sun, 27 Dec 2020 23:54:35 +0100 Subject: [PATCH 019/206] Update manage-windows-20H2-endpoints.md From issue ticket #8873 (**typo in FQDN**) : > The FQDN "1storecatalogrevocation.storequality.microsoft.com" does not exist, it should probably be "storecatalogrevocation.storequality.microsoft.com" See also the comment below, stating as follows: > It would probably make sense to merge the lines and use "TLSv1.2/HTTPS/HTTP" as the protocol like on other lines. > I did not see any use of 1storecatalogrevocation.storequality.microsoft.com in my tests, also there is no A or AAAA DNS record for this endpoint, which makes me assume this is a typo. Thanks to ruffy91 for noticing and reporting this typo issue. Changes proposed: - Remove the leading digit 1 from the hostname in `1storecatalogrevocation.storequality.microsoft.com` - Remove 1 redundant `HTTPS` from the row below, making it only `HTTPS/HTTP` - Merge the 2 lines since they now point to the same host FQDN Whitespace changes: - add 1 editorial blank line between the metadata section and the page title - remove 2 redundant end-of-line blanks Closes #8873 --- windows/privacy/manage-windows-20H2-endpoints.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/privacy/manage-windows-20H2-endpoints.md b/windows/privacy/manage-windows-20H2-endpoints.md index a2c7dbbed9..57c2ce989d 100644 --- a/windows/privacy/manage-windows-20H2-endpoints.md +++ b/windows/privacy/manage-windows-20H2-endpoints.md @@ -14,6 +14,7 @@ ms.collection: M365-security-compliance ms.topic: article ms.date: 12/17/2020 --- + # Manage connection endpoints for Windows 10 Enterprise, version 20H2 **Applies to** @@ -35,7 +36,7 @@ The following methodology was used to derive these network endpoints: 1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. 2. Leave the device(s) running idle for a week ("idle" means a user is not interacting with the system/device). -3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. 4. Compile reports on traffic going to public IP addresses. 5. The test virtual machine(s) was logged into using a local account, and was not joined to a domain or Azure Active Directory. 6. All traffic was captured in our lab using a IPV4 network. Therefore, no IPV6 traffic is reported here. @@ -85,8 +86,7 @@ The following methodology was used to derive these network endpoints: |Microsoft Store|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| ||The following endpoint is used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps). If you turn off traffic for these endpoints, the image files won't be downloaded, and apps cannot be installed or updated from the Microsoft Store. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.|HTTPS|img-prod-cms-rt-microsoft-com.akamaized.net| ||The following endpoint is used for the Windows Push Notification Services (WNS). WNS enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way. If you turn off traffic for this endpoint, push notifications will no longer work, including MDM device management, mail synchronization, settings synchronization.|TLSv1.2/HTTPS|*.wns.windows.com| -||The following endpoints are used to revoke licenses for malicious apps in the Microsoft Store. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft Store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them|TLSv1.2|1storecatalogrevocation.storequality.microsoft.com| -|||HTTPS/HTTPS/HTTP|storecatalogrevocation.storequality.microsoft.com| +||The following endpoints are used to revoke licenses for malicious apps in the Microsoft Store. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft Store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them|TLSv1.2/HTTPS/HTTP|storecatalogrevocation.storequality.microsoft.com| ||The following endpoint is used to get Microsoft Store analytics.|HTTPS|manage.devcenter.microsoft.com| ||The following endpoints are used to communicate with Microsoft Store. If you turn off traffic for these endpoints, apps cannot be installed or updated from the Microsoft Store.|TLSv1.2/HTTPS/HTTP|displaycatalog.mp.microsoft.com| |||HTTPS|pti.store.microsoft.com| @@ -130,7 +130,7 @@ The following methodology was used to derive these network endpoints: ||The following endpoint is used for content regulation. If you turn off traffic for this endpoint, the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly downloaded or not downloaded at all.|TLSv1.2/HTTPS/HTTP|tsfe.trafficshaping.dsp.mp.microsoft.com| |Xbox Live|The following endpoint is used for Xbox Live.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services#26-microsoft-store)| |||HTTPS|dlassets-ssl.xboxlive.com| -| + ## Other Windows 10 editions From 41e8df746f3b9c42482e7ef178742adec589c89e Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Mon, 28 Dec 2020 22:59:10 +0500 Subject: [PATCH 020/206] Broken link update A link to the OMA standard was broken and has been updated to the correct one. --- .../mdm/disconnecting-from-mdm-unenrollment.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md index 3cb1682333..36cae102c0 100644 --- a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md +++ b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md @@ -44,7 +44,7 @@ In Windows, after the user confirms the account deletion command and before the This action utilizes the OMA DM generic alert 1226 function to send a user an MDM unenrollment user alert to the MDM server after the device accepts the user unenrollment request, but before it deletes any enterprise data. The server should set the expectation that unenrollment may succeed or fail, and the server can check whether the device is unenrolled by either checking whether the device calls back at scheduled time or by sending a push notification to the device to see whether it responds back. If the server plans to send a push notification, it should allow for some delay to give the device the time to complete the unenrollment work. -> **Note**  The user unenrollment is an OMA DM standard. For more information about the 1226 generic alert, refer to the OMA Device Management Protocol specification (OMA-TS-DM\_Protocol-V1\_2\_1-20080617-A), available from the [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=267526). +> **Note**  The user unenrollment is an OMA DM standard. For more information about the 1226 generic alert, refer to the OMA Device Management Protocol specification (OMA-TS-DM\_Protocol-V1\_2\_1-20080617-A), available from the [OMA website](https://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/).   The vendor uses the Type attribute to specify what type of generic alert it is. For device initiated MDM unenrollment, the alert type is **com.microsoft:mdm.unenrollment.userrequest**. From 8368db79c2613c1caf186d34aab485675bc7f2d1 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Tue, 29 Dec 2020 11:12:43 +0500 Subject: [PATCH 021/206] Update windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../mdm/disconnecting-from-mdm-unenrollment.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md index 36cae102c0..35fe6568b0 100644 --- a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md +++ b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md @@ -44,7 +44,8 @@ In Windows, after the user confirms the account deletion command and before the This action utilizes the OMA DM generic alert 1226 function to send a user an MDM unenrollment user alert to the MDM server after the device accepts the user unenrollment request, but before it deletes any enterprise data. The server should set the expectation that unenrollment may succeed or fail, and the server can check whether the device is unenrolled by either checking whether the device calls back at scheduled time or by sending a push notification to the device to see whether it responds back. If the server plans to send a push notification, it should allow for some delay to give the device the time to complete the unenrollment work. -> **Note**  The user unenrollment is an OMA DM standard. For more information about the 1226 generic alert, refer to the OMA Device Management Protocol specification (OMA-TS-DM\_Protocol-V1\_2\_1-20080617-A), available from the [OMA website](https://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/). +> [!NOTE] +> The user unenrollment is an OMA DM standard. For more information about the 1226 generic alert, refer to the OMA Device Management Protocol specification (OMA-TS-DM\_Protocol-V1\_2\_1-20080617-A), available from the [OMA website](https://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/).   The vendor uses the Type attribute to specify what type of generic alert it is. For device initiated MDM unenrollment, the alert type is **com.microsoft:mdm.unenrollment.userrequest**. @@ -157,4 +158,3 @@ When the disconnection is completed, the user is notified that the device has be - From 3403fc0d96b4e8e6dfc684c3f2f16c7149cc0614 Mon Sep 17 00:00:00 2001 From: AlastairBateman <10553180+AlastairBateman@users.noreply.github.com> Date: Thu, 31 Dec 2020 21:48:19 +1100 Subject: [PATCH 022/206] Fixing a minor typo (Brose -> Browse) --- .../hello-for-business/hello-cert-trust-adfs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md index 8e3e7d4f74..a3f57c0d37 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md @@ -41,7 +41,7 @@ Prepare the Active Directory Federation Services deployment by installing and up > [!NOTE] >For AD FS 2019, if Windows Hello for Business with a Hybrid Certificate trust is performed, a known PRT issue exists. You may encounter this error in ADFS Admin event logs: Received invalid Oauth request. The client 'NAME' is forbidden to access the resource with scope 'ugs'. To remediate this error: > -> 1. Launch AD FS management console. Brose to "Services > Scope Descriptions". +> 1. Launch AD FS management console. Browse to "Services > Scope Descriptions". > 2. Right click "Scope Descriptions" and select "Add Scope Description". > 3. Under name type "ugs" and Click Apply > OK. > 4. Launch PowerShell as an administrator. From 95c5435faeb9e2f77e12a5366bc848e0b3820588 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Thu, 31 Dec 2020 18:52:49 +0500 Subject: [PATCH 023/206] Addition of note As suggested by the user, the rule Block executable content from email client and webmail, have some different names depending on where we are looking at. Keeping this in view, I have created a PR to add a note for the same. Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/8556 --- .../microsoft-defender-atp/attack-surface-reduction.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index a0586d3024..238b8d7a79 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -243,6 +243,12 @@ Microsoft Endpoint Configuration Manager name: `Block executable content from em GUID: `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` +> [!Note] +> The rule **Block executable content from email client and webmail** is also reffered as following. +> Intune (Configuration Profiles): Execution of executable content (exe, dll, ps, js, vbs, etc.) dropped from email (webmail/mail client) (no exceptions) +> Endpoint Manager: Block executable content download from email and webmail clients +> Group Policy: Block executable content from email client and webmail + ### Block executable files from running unless they meet a prevalence, age, or trusted list criterion This rule blocks the following file types from launching unless they meet prevalence or age criteria, or they're in a trusted list or an exclusion list: From f2bcf45ebd366d15b832e6318b4611fc63b8e8cd Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Thu, 31 Dec 2020 20:37:11 +0500 Subject: [PATCH 024/206] Update windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../microsoft-defender-atp/attack-surface-reduction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 238b8d7a79..90dcfbad85 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -244,7 +244,7 @@ Microsoft Endpoint Configuration Manager name: `Block executable content from em GUID: `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` > [!Note] -> The rule **Block executable content from email client and webmail** is also reffered as following. +> The rule **Block executable content from email client and webmail** has the following separate descriptions, depending on which application you use: > Intune (Configuration Profiles): Execution of executable content (exe, dll, ps, js, vbs, etc.) dropped from email (webmail/mail client) (no exceptions) > Endpoint Manager: Block executable content download from email and webmail clients > Group Policy: Block executable content from email client and webmail From ded8a8e23ca92c7d98cc0cdc6865006ea8031de6 Mon Sep 17 00:00:00 2001 From: AlastairBateman <10553180+AlastairBateman@users.noreply.github.com> Date: Fri, 1 Jan 2021 08:54:05 +1100 Subject: [PATCH 025/206] Added Markdown indentation Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../hello-for-business/hello-cert-trust-adfs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md index a3f57c0d37..18abc2bc44 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md @@ -39,7 +39,7 @@ A new Active Directory Federation Services farm should have a minimum of two fed Prepare the Active Directory Federation Services deployment by installing and updating two Windows Server 2016 Servers. Ensure the update listed below is applied to each server before continuing. > [!NOTE] ->For AD FS 2019, if Windows Hello for Business with a Hybrid Certificate trust is performed, a known PRT issue exists. You may encounter this error in ADFS Admin event logs: Received invalid Oauth request. The client 'NAME' is forbidden to access the resource with scope 'ugs'. To remediate this error: +> For AD FS 2019, if Windows Hello for Business with a Hybrid Certificate trust is performed, a known PRT issue exists. You may encounter this error in ADFS Admin event logs: Received invalid Oauth request. The client 'NAME' is forbidden to access the resource with scope 'ugs'. To remediate this error: > > 1. Launch AD FS management console. Browse to "Services > Scope Descriptions". > 2. Right click "Scope Descriptions" and select "Add Scope Description". From 10a7156ee97e4595336ddfccdb17a3e9aed68854 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Fri, 1 Jan 2021 13:47:50 +0500 Subject: [PATCH 026/206] Update dg-readiness-tool.md --- .../identity-protection/credential-guard/dg-readiness-tool.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/dg-readiness-tool.md b/windows/security/identity-protection/credential-guard/dg-readiness-tool.md index e609c9469d..76ff4796bb 100644 --- a/windows/security/identity-protection/credential-guard/dg-readiness-tool.md +++ b/windows/security/identity-protection/credential-guard/dg-readiness-tool.md @@ -732,11 +732,11 @@ function IsDomainController function CheckOSSKU { - $osname = $((gwmi win32_operatingsystem).Name).ToLower() + $osname = $((Get-ComputerInfo).WindowsProductName).ToLower() $_SKUSupported = 0 Log "OSNAME:$osname" $SKUarray = @("Enterprise", "Education", "IoT", "Windows Server") - $HLKAllowed = @("microsoft windows 10 pro") + $HLKAllowed = @("windows 10 pro") foreach ($SKUent in $SKUarray) { if($osname.ToString().Contains($SKUent.ToLower())) From d8a892afa921d0a08022a391754486355dea6b49 Mon Sep 17 00:00:00 2001 From: Peter Upfold Date: Fri, 1 Jan 2021 10:52:08 +0000 Subject: [PATCH 027/206] Fix typo MTD -> MDT --- .../prepare-for-windows-deployment-with-mdt.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md index 52246fddfd..c4445493e4 100644 --- a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md +++ b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md @@ -81,7 +81,7 @@ The following OU structure is used in this guide. Instructions are provided [bel These steps assume that you have the MDT01 member server running and configured as a domain member server. -On **MTD01**: +On **MDT01**: Visit the [Download and install the Windows ADK](https://go.microsoft.com/fwlink/p/?LinkId=526803) page and download the following items to the **D:\\Downloads\\ADK** folder on MDT01 (you will need to create this folder): - [The Windows ADK for Windows 10](https://go.microsoft.com/fwlink/?linkid=2086042) From ebd3cf2155fe6c6aee87510f5a1590f3ef0427f8 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Fri, 1 Jan 2021 21:02:55 +0500 Subject: [PATCH 028/206] Update windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../microsoft-defender-atp/attack-surface-reduction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 90dcfbad85..9733c8b74f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -243,7 +243,7 @@ Microsoft Endpoint Configuration Manager name: `Block executable content from em GUID: `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` -> [!Note] +> [!NOTE] > The rule **Block executable content from email client and webmail** has the following separate descriptions, depending on which application you use: > Intune (Configuration Profiles): Execution of executable content (exe, dll, ps, js, vbs, etc.) dropped from email (webmail/mail client) (no exceptions) > Endpoint Manager: Block executable content download from email and webmail clients From a722bb8029655ae4834e065fba5ec08ec18bbebe Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Fri, 1 Jan 2021 21:03:12 +0500 Subject: [PATCH 029/206] Update windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../microsoft-defender-atp/attack-surface-reduction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 9733c8b74f..43ded78026 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -245,7 +245,7 @@ GUID: `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` > [!NOTE] > The rule **Block executable content from email client and webmail** has the following separate descriptions, depending on which application you use: -> Intune (Configuration Profiles): Execution of executable content (exe, dll, ps, js, vbs, etc.) dropped from email (webmail/mail client) (no exceptions) +- > Intune (Configuration Profiles): Execution of executable content (exe, dll, ps, js, vbs, etc.) dropped from email (webmail/mail client) (no exceptions). > Endpoint Manager: Block executable content download from email and webmail clients > Group Policy: Block executable content from email client and webmail From c2a94c61c7c35f76b7b9c49cf583347be2753a5f Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Fri, 1 Jan 2021 21:03:24 +0500 Subject: [PATCH 030/206] Update windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../microsoft-defender-atp/attack-surface-reduction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 43ded78026..56bb500c7a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -246,7 +246,7 @@ GUID: `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` > [!NOTE] > The rule **Block executable content from email client and webmail** has the following separate descriptions, depending on which application you use: - > Intune (Configuration Profiles): Execution of executable content (exe, dll, ps, js, vbs, etc.) dropped from email (webmail/mail client) (no exceptions). -> Endpoint Manager: Block executable content download from email and webmail clients +- > Endpoint Manager: Block executable content download from email and webmail clients. > Group Policy: Block executable content from email client and webmail ### Block executable files from running unless they meet a prevalence, age, or trusted list criterion From 161b98ac44b9c011314382518b11f8f3b286262d Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Fri, 1 Jan 2021 21:03:33 +0500 Subject: [PATCH 031/206] Update windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../microsoft-defender-atp/attack-surface-reduction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 56bb500c7a..a879459cd9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -247,7 +247,7 @@ GUID: `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` > The rule **Block executable content from email client and webmail** has the following separate descriptions, depending on which application you use: - > Intune (Configuration Profiles): Execution of executable content (exe, dll, ps, js, vbs, etc.) dropped from email (webmail/mail client) (no exceptions). - > Endpoint Manager: Block executable content download from email and webmail clients. -> Group Policy: Block executable content from email client and webmail +- > Group Policy: Block executable content from email client and webmail. ### Block executable files from running unless they meet a prevalence, age, or trusted list criterion From e23d0de48a6fa550f9055ee447a66d0ba1b8dae5 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Fri, 1 Jan 2021 21:03:55 +0500 Subject: [PATCH 032/206] Update windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../microsoft-defender-atp/attack-surface-reduction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index a879459cd9..212256ae38 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -244,7 +244,7 @@ Microsoft Endpoint Configuration Manager name: `Block executable content from em GUID: `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` > [!NOTE] -> The rule **Block executable content from email client and webmail** has the following separate descriptions, depending on which application you use: +> The rule **Block executable content from email client and webmail** has the following alternative descriptions, depending on which application you use: - > Intune (Configuration Profiles): Execution of executable content (exe, dll, ps, js, vbs, etc.) dropped from email (webmail/mail client) (no exceptions). - > Endpoint Manager: Block executable content download from email and webmail clients. - > Group Policy: Block executable content from email client and webmail. From edd467581c1a0ddab89d37cdbfaac8955691d959 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Sat, 2 Jan 2021 07:31:44 +0100 Subject: [PATCH 033/206] MarkDown formatting, whitespace consistency, typos This PR is meant to make it easier for the next editor of this page to start with a known ordered content, with regards to layout formatting, general typos and MarkDown usage. Viewing this content in Rich Diff view, or without the "Hide whitespace changes" feature, might look confusing or disordered. Changes proposed: - MarkDown formatting improvements (incorrect usage/layout corrected and properly formatted) - Whitespace corrections, both for consistency, codestyle, and for easier future editing - Typo corrections and a couple of minor phrasing adjustments for readability & coherency Ref. my comments in PR #8732 and at the end of issue ticket #8548 (regarding incorrect MarkDown code block usage) --- .../hello-hybrid-aadj-sso-cert.md | 242 ++++++++++-------- 1 file changed, 135 insertions(+), 107 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 95638c7735..e8dc2df8f2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -1,7 +1,7 @@ --- title: Using Certificates for AADJ On-premises Single-sign On single sign-on description: If you want to use certificates for on-premises single-sign on for Azure Active Directory joined devices, then follow these additional steps. -keywords: identity, PIN, biometric, Hello, passport, AADJ, SSO, +keywords: identity, PIN, biometric, Hello, passport, AADJ, SSO, ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -14,11 +14,12 @@ ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 -ms.reviewer: +ms.reviewer: --- + # Using Certificates for AADJ On-premises Single-sign On -**Applies to** +**Applies to:** - Windows 10 - Azure Active Directory joined - Hybrid Deployment @@ -27,7 +28,7 @@ ms.reviewer: If you plan to use certificates for on-premises single-sign on, then follow these **additional** steps to configure the environment to enroll Windows Hello for Business certificates for Azure AD joined devices. > [!IMPORTANT] -> Ensure you have performed the configurations in [Azure AD joined devices for On-premises Single-Sign On](hello-hybrid-aadj-sso-base.md) before you continue. +> Ensure you have performed the configurations in [Azure AD joined devices for On-premises Single-Sign On](hello-hybrid-aadj-sso-base.md) before you continue. Steps you will perform include: - [Prepare Azure AD Connect](#prepare-azure-ad-connect) @@ -45,7 +46,7 @@ You need to install and configure additional infrastructure to provide Azure AD - A Windows Server 2012 R2 domain joined server that hosts the Network Device Enrollment Services role ### High Availaibilty -The Network Device Enrollment Services (NDES) server role acts as a certificate registration authority. Certificate registration servers enroll certificates on behalf of the user. Users request certificates from the NDES service rather than directly from the issuing certificate authority. +The Network Device Enrollment Services (NDES) server role acts as a certificate registration authority. Certificate registration servers enroll certificates on behalf of the user. Users request certificates from the NDES service rather than directly from the issuing certificate authority. The architecture of the NDES server prevents it from being clustered or load balanced for high availability. To provide high availability, you need to install more than one identically configured NDES servers and use Microsoft Intune to load balance then (in round-robin fashion). @@ -58,14 +59,14 @@ The Network Device Enrollment Service (NDES) server role can issue up to three u If you need to deploy more than three types of certificates to the Azure AD joined device, you need additional NDES servers. Alternatively, consider consolidating certificates templates to reduce the number of certificate templates. ### Network Requirements -All communication occurs securely over port 443. +All communication occurs securely over port 443. ## Prepare Azure AD Connect Successful authentication to on-premises resources using a certificate requires the certificate to provide a hint about the on-premises domain. The hint can be the user's Active Directory distinguished name as the subject of the certificate, or the hint can be the user's user principal name where the suffix matches the Active Directory domain name. Most environments change the user principal name suffix to match the organization's external domain name (or vanity domain), which prevents the user principal name as a hint to locate a domain controller. Therefore, the certificate needs the user's on-premises distinguished name in the subject to properly locate a domain controller. -To include the on-premises distinguished name in the certificate's subject, Azure AD Connect must replicate the Active Directory **distinguishedName** attribute to the Azure Active Directory **onPremisesDistinguishedName** attribute. Azure AD Connect version 1.1.819 includes the proper synchronization rules need to for these attributes. +To include the on-premises distinguished name in the certificate's subject, Azure AD Connect must replicate the Active Directory **distinguishedName** attribute to the Azure Active Directory **onPremisesDistinguishedName** attribute. Azure AD Connect version 1.1.819 includes the proper synchronization rules need to for these attributes. ### Verify AAD Connect version Sign-in to computer running Azure AD Connect with access equivalent to _local administrator_. @@ -100,8 +101,8 @@ Sign-in to a domain controller or management workstation with access equivalent Sign-in to a domain controller or management workstation with access equivalent to _domain administrator_. 1. Open **Active Directory Users and Computers**. -2. Expand the domain node from the navigation pane. -3. Click **Computers** from the navigation pane. Right-click the name of the NDES server that will host the NDES server role. Click **Add to a group...**. +2. Expand the domain node from the navigation pane. +3. Click **Computers** from the navigation pane. Right-click the name of the NDES server that will host the NDES server role. Click **Add to a group...**. 4. Type **NDES Servers** in **Enter the object names to select**. Click **OK**. Click **OK** on the **Active Directory Domain Services** success dialog. > [!NOTE] @@ -118,7 +119,7 @@ Sign-in to a domain controller or management workstation with access equivalent 4. Click **Finish**. > [!IMPORTANT] -> Configuring the service's account password to **Password never expires** may be more convenient, but it presents a security risk. Normal service account passwords should expire in accordance with the organizations user password expiration policy. Create a reminder to change the service account's password two weeks before it will expire. Share the reminder with others that are allowed to change the password to ensure the password is changed before it expires. +> Configuring the service's account password to **Password never expires** may be more convenient, but it presents a security risk. Normal service account passwords should expire in accordance with the organizations user password expiration policy. Create a reminder to change the service account's password two weeks before it will expire. Share the reminder with others that are allowed to change the password to ensure the password is changed before it expires. ### Create the NDES Service User Rights Group Policy object The Group Policy object ensures the NDES Service account has the proper user right assign all the NDES servers in the **NDES Servers** group. As you add new NDES servers to your environment and this group, the service account automatically receives the proper user rights through Group Policy. @@ -135,10 +136,10 @@ Sign-in a domain controller or management workstations with _Domain Admin_ equiv 8. In the content pane, double-click **Allow log on locally**. Select **Define these policy settings** and click **OK**. Click **Add User or Group...**. In the **Add User or Group** dialog box, click **Browse**. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, type **Administrators;Backup Operators;DOMAINNAME\NDESSvc;Users** where **DOMAINNAME** is the NetBios name of the domain (Example CONTOSO\NDESSvc) in **User and group names**. Click **OK** twice. 9. In the content pane, double-click **Log on as a batch job**. Select **Define these policy settings** and click **OK**. Click **Add User or Group...**. In the **Add User or Group** dialog box, click **Browse**. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, type **Administrators;Backup Operators;DOMAINNAME\NDESSvc;Performance Log Users** where **DOMAINNAME** is the NetBios name of the domain (Example CONTOSO\NDESSvc) in **User and group names**. Click **OK** twice. 10. In the content pane, double-click **Log on as a service**. Select **Define these policy settings** and click **OK**. Click **Add User or Group...**. In the **Add User or Group** dialog box, click **Browse**. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, type **NT SERVICE\ALL SERVICES;DOMAINNAME\NDESSvc** where **DOMAINNAME** is the NetBios name of the domain (Example CONTOSO\NDESSvc) in **User and group names**. Click **OK** three times. -11. Close the **Group Policy Management Editor**. +11. Close the **Group Policy Management Editor**. ### Configure security for the NDES Service User Rights Group Policy object -The best way to deploy the **NDES Service User Rights** Group Policy object is to use security group filtering. This enables you to easily manage the computers that receive the Group Policy settings by adding them to a group. +The best way to deploy the **NDES Service User Rights** Group Policy object is to use security group filtering. This enables you to easily manage the computers that receive the Group Policy settings by adding them to a group. Sign-in to a domain controller or management workstation with access equivalent to _domain administrator_. @@ -159,7 +160,7 @@ Sign-in to a domain controller or management workstation with access equivalent 3. In the **Select GPO** dialog box, select **NDES Service User Rights** or the name of the Group Policy object you previously created and click **OK**. > [!IMPORTANT] -> Linking the **NDES Service User Rights** Group Policy object to the domain ensures the Group Policy object is in scope for all computers. However, not all computers will have the policy settings applied to them. Only computers that are members of the **NDES Servers** global security group receive the policy settings. All others computers ignore the Group Policy object. +> Linking the **NDES Service User Rights** Group Policy object to the domain ensures the Group Policy object is in scope for all computers. However, not all computers will have the policy settings applied to them. Only computers that are members of the **NDES Servers** global security group receive the policy settings. All others computers ignore the Group Policy object. ## Prepare Active Directory Certificate Authority You must prepare the public key infrastructure and the issuing certificate authority to support issuing certificates using Microsoft Intune and the Network Devices Enrollment Services (NDES) server role. In this task, you will @@ -177,46 +178,52 @@ When deploying certificates using Microsoft Intune, you have the option of provi Sign-in to the issuing certificate authority with access equivalent to _local administrator_. -1. Open and elevated command prompt. Type the command +1. Open an elevated command prompt and type the following command: ``` certutil -setreg Policy\EditFlags +EDITF_ATTRIBUTEENDDATE ``` -2. Restart the **Active Directory Certificate Services** service. +2. Restart the **Active Directory Certificate Services** service. ### Create an NDES-Intune authentication certificate template -NDES uses a server authentication certificate to authenticate the server endpoint, which encrypts the communication between it and the connecting client. The Intune Certificate Connector uses a client authentication certificate template to authenticate to the certificate registration point. +NDES uses a server authentication certificate to authenticate the server endpoint, which encrypts the communication between it and the connecting client. The Intune Certificate Connector uses a client authentication certificate template to authenticate to the certificate registration point. Sign-in to the issuing certificate authority or management workstations with _Domain Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. +1. Open the **Certificate Authority** management console. 2. Right-click **Certificate Templates** and click **Manage**. 3. In the **Certificate Template Console**, right-click the **Computer** template in the details pane and click **Duplicate Template**. -4. On the **General** tab, type **NDES-Intune Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. - **Note:** If you use different template names, you'll need to remember and substitute these names in different portions of the lab. -5. On the **Subject** tab, select **Supply in the request**. -6. On the **Cryptography** tab, validate the **Minimum key size** is **2048**. -7. On the **Security** tab, click **Add**. -8. Type **NDES server** in the **Enter the object names to select** text box and click **OK**. -9. Select **NDES server** from the **Group or users names** list. In the **Permissions for** section, select the **Allow** check box for the **Enroll** permission. Clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. -10. Click on the **Apply** to save changes and close the console. +4. On the **General** tab, type **NDES-Intune Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. + + > [!NOTE] + > If you use different template names, you'll need to remember and substitute these names in different portions of the lab. + +5. On the **Subject** tab, select **Supply in the request**. +6. On the **Cryptography** tab, validate the **Minimum key size** is **2048**. +7. On the **Security** tab, click **Add**. +8. Type **NDES server** in the **Enter the object names to select** text box and click **OK**. +9. Select **NDES server** from the **Group or users names** list. In the **Permissions for** section, select the **Allow** check box for the **Enroll** permission. Clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. +10. Click on the **Apply** to save changes and close the console. ### Create an Azure AD joined Windows Hello for Business authentication certificate template During Windows Hello for Business provisioning, Windows 10 requests an authentication certificate from the Microsoft Intune, which requests the authentication certificate on behalf of the user. This task configures the Windows Hello for Business authentication certificate template. You use the name of the certificate template when configuring the NDES Server. -Sign-in a certificate authority or management workstations with _Domain Admin equivalent_ credentials. +Sign in a certificate authority or management workstations with _Domain Admin equivalent_ credentials. 1. Open the **Certificate Authority** management console. 2. Right-click **Certificate Templates** and click **Manage**. 3. Right-click the **Smartcard Logon** template and choose **Duplicate Template**. 4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. -5. On the **General** tab, type **AADJ WHFB Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. - **Note:** If you use different template names, you'll need to remember and substitute these names in different portions of the deployment. -6. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. +5. On the **General** tab, type **AADJ WHFB Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. + + > [!NOTE] + > If you use different template names, you'll need to remember and substitute these names in different portions of the deployment. + +6. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. 7. On the **Extensions** tab, verify the **Application Policies** extension includes **Smart Card Logon**. 8. On the **Subject** tab, select **Supply in the request**. 9. On the **Request Handling** tab, select **Signature and encryption** from the **Purpose** list. Select the **Renew with same key** check box. Select **Enroll subject without requiring any user input**. 10. On the **Security** tab, click **Add**. Type **NDESSvc** in the **Enter the object names to select** text box and click **OK**. -12. Select **NDESSvc** from the **Group or users names** list. In the **Permissions for NDES Servers** section, select the **Allow** check box for the **Read**, **Enroll**. Clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. +12. Select **NDESSvc** from the **Group or users names** list. In the **Permissions for NDES Servers** section, select the **Allow** check box for the **Read**, **Enroll**. Clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. 13. Close the console. ### Publish certificate templates @@ -231,7 +238,7 @@ Sign-in to the certificate authority or management workstations with an _Enterpr 2. Expand the parent node from the navigation pane. 3. Click **Certificate Templates** in the navigation pane. 4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template** to issue. -5. In the **Enable Certificates Templates** window, select the **NDES-Intune Authentication** and **AADJ WHFB Authentication** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. +5. In the **Enable Certificates Templates** window, select the **NDES-Intune Authentication** and **AADJ WHFB Authentication** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. 6. Close the console. ## Install and Configure the NDES Role @@ -250,10 +257,10 @@ Install the Network Device Enrollment Service role on a computer other than the Sign-in to the certificate authority or management workstations with an _Enterprise Admin_ equivalent credentials. 1. Open **Server Manager** on the NDES server. -2. Click **Manage**. Click **Add Roles and Features**. +2. Click **Manage**. Click **Add Roles and Features**. 3. In the **Add Roles and Features Wizard**, on the **Before you begin** page, click **Next**. Select **Role-based or feature-based installation** on the **Select installation type** page. Click **Next**. Click **Select a server from the server pool**. Select the local server from the **Server Pool** list. Click **Next**. ![Server Manager destination server](images/aadjCert/servermanager-destination-server-ndes.png) -4. On the **Select server roles** page, select **Active Directory Certificate Services** from the **Roles** list. +4. On the **Select server roles** page, select **Active Directory Certificate Services** from the **Roles** list. ![Server Manager AD CS Role](images/aadjCert/servermanager-adcs-role.png) Click **Add Features** on the **Add Roles and Feature Wizard** dialog box. Click **Next**. ![Server Manager Add Features](images/aadjcert/serverManager-adcs-add-features.png) @@ -271,7 +278,7 @@ Sign-in to the certificate authority or management workstations with an _Enterpr ![Server Manager Web Server Role](images/aadjcert/servermanager-adcs-webserver-role.png) 9. Click **Install**. When the installation completes, continue with the next procedure. **Do not click Close**. > [!Important] - > The .NET Framework 3.5 is not included in the typical installation. If the server is connected to the Internet, the installation attempts to get the files using Windows Update. If the server is not connected to the Internet, you need to **Specify an alternate source path** such as \:\\Sources\SxS\ + > .NET Framework 3.5 is not included in the typical installation. If the server is connected to the Internet, the installation attempts to get the files using Windows Update. If the server is not connected to the Internet, you need to **Specify an alternate source path** such as \:\\Sources\SxS\ ![.NET Side by Side](images/aadjcert/dotNet35sidebyside.png) ### Configure the NDES service account @@ -280,7 +287,7 @@ This task adds the NDES service account to the local IIS_USRS group. The task a #### Add the NDES service account to the IIS_USRS group Sign-in the NDES server with access equivalent to _local administrator_. -1. Start the **Local Users and Groups** management console (lusrmgr.msc). +1. Start the **Local Users and Groups** management console (`lusrmgr.msc`). 2. Select **Groups** from the navigation pane. Double-click the IIS_IUSRS group. 3. In the **IIS_IUSRS Properties** dialog box, click **Add**. Type **NDESSvc** or the name of your NDES service account. Click **Check Names** to verify the name and then click **OK**. Click **OK** to close the properties dialog box. 4. Close the management console. @@ -289,10 +296,14 @@ Sign-in the NDES server with access equivalent to _local administrator_. Sign-in the NDES server with a access equivalent to _Domain Admins_. 1. Open an elevated command prompt. -2. Type the following command to register the service principal name
    -```setspn -s http/[FqdnOfNdesServer] [DomainName\\NdesServiceAccount]```
    -where **[FqdnOfNdesServer]** is the fully qualified domain name of the NDES server and **[DomainName\NdesServiceAccount]** is the domain name and NDES service account name separated by a backslash (\\). An example of the command looks like the following.
    -```setspn -s http/ndes.corp.contoso.com contoso\ndessvc``` +2. Type the following command to register the service principal name + ``` + setspn -s http/[FqdnOfNdesServer] [DomainName\\NdesServiceAccount] + ``` + where **[FqdnOfNdesServer]** is the fully qualified domain name of the NDES server and **[DomainName\NdesServiceAccount]** is the domain name and NDES service account name separated by a backslash (\\). An example of the command looks like the following: + ``` + setspn -s http/ndes.corp.contoso.com contoso\ndessvc + ``` > [!NOTE] > If you use the same service account for multiple NDES Servers, repeat the following task for each NDES server under which the NDES service runs. @@ -306,16 +317,16 @@ Sign-in a domain controller with a minimum access equivalent to _Domain Admins_. 1. Open **Active Directory Users and Computers** 2. Locate the NDES Service account (NDESSvc). Right-click and select **Properties**. Click the **Delegation** tab. -![NDES Delegation Tab](images/aadjcert/ndessvcdelegationtab.png) + ![NDES Delegation Tab](images/aadjcert/ndessvcdelegationtab.png) 3. Select **Trust this user for delegation to specified services only**. 4. Select **Use any authentication protocol**. 5. Click **Add**. 6. Click **Users or Computers...** Type the name of the _NDES Server_ you use to issue Windows Hello for Business authentication certificates to Azure AD joined devices. From the **Avaiable services** list, select **HOST**. Click **OK**. -![NDES Service delegation to NDES host](images/aadjcert/ndessvcdelegation-host-ndes-spn.png) + ![NDES Service delegation to NDES host](images/aadjcert/ndessvcdelegation-host-ndes-spn.png) 7. Repeat steps 5 and 6 for each NDES server using this service account.8. Click **Add**. 8. Click **Users or computers...** Type the name of the issuing certificate authority this NDES service account uses to issue Windows Hello for Business authentication certificates to Azure AD joined devices. From the **Available services** list, select **dcom**. Hold the **CTRL** key and select **HOST**. Click **OK**. 9. Repeat steps 8 and 9 for each issuing certificate authority from which one or more NDES servers request certificates. -![NDES Service delegation complete](images/aadjcert/ndessvcdelegation-host-ca-spn.png) + ![NDES Service delegation complete](images/aadjcert/ndessvcdelegation-host-ca-spn.png) 10. Click **OK**. Close **Active Directory Users and Computers**. ### Configure the NDES Role and Certificate Templates @@ -325,61 +336,65 @@ This task configures the NDES role and the certificate templates the NDES server Sign-in to the certificate authority or management workstations with an _Enterprise Admin_ equivalent credentials. > [!NOTE] -> If you closed Server Manger from the last set of tasks, start Server Manager and click the action flag that shows a yellow exclamation point. +> If you closed Server Manger from the last set of tasks, start Server Manager and click the action flag that shows a yellow exclamation point. ![Server Manager Post-Install Yellow flag](images/aadjcert/servermanager-post-ndes-yellowactionflag.png) 1. Click the **Configure Active Directory Certificate Services on the destination server** link. 2. On the **Credentials** page, click **Next**. -![NDES Installation Credentials](images/aadjcert/ndesconfig01.png) + ![NDES Installation Credentials](images/aadjcert/ndesconfig01.png) 3. On the **Role Services** page, select **Network Device Enrollment Service** and then click **Next** -![NDES Role Services](images/aadjcert/ndesconfig02.png) + ![NDES Role Services](images/aadjcert/ndesconfig02.png) 4. On the **Service Account for NDES** page, select **Specify service account (recommended)**. Click **Select...** Type the user name and password for the NDES service account in the **Windows Security** dialog box. Click **Next**. -![NDES Service Account for NDES](images/aadjcert/ndesconfig03b.png) + ![NDES Service Account for NDES](images/aadjcert/ndesconfig03b.png) 5. On the **CA for NDES** page, select **CA name**. Click **Select...**. Select the issuing certificate authority from which the NDES server requests certificates. Click **Next**. -![NDES CA selection](images/aadjcert/ndesconfig04.png) + ![NDES CA selection](images/aadjcert/ndesconfig04.png) 6. On the **RA Information**, click **Next**. 7. On the **Cryptography for NDES** page, click **Next**. 8. Review the **Confirmation** page. Click **Configure**. -![NDES Confirmation](images/aadjcert/ndesconfig05.png) + ![NDES Confirmation](images/aadjcert/ndesconfig05.png) 8. Click **Close** after the configuration completes. #### Configure Certificate Templates on NDES -A single NDES server can request a maximum of three certificate template. The NDES server determines which certificate to issue based on the incoming certificate request that is assigned in the Microsoft Intune SCEP certificate profile. The Microsoft Intune SCEP certificate profile has three values. +A single NDES server can request a maximum of three certificate template. The NDES server determines which certificate to issue based on the incoming certificate request that is assigned in the Microsoft Intune SCEP certificate profile. The Microsoft Intune SCEP certificate profile has three values. * Digital Signature * Key Encipherment * Key Encipherment, Digital Signature Each value maps to a registry value name in the NDES server. The NDES server translate an incoming SCEP provide value into the correspond certificate template. The table belows shows the SCEP profile value to the NDES certificate template registry value name -|SCEP Profile Key usage| NDES Registry Value Name| -|:----------:|:-----------------------:| -|Digital Signature|SignatureTemplate| -|Key Encipherment|EncryptionTemplate| -|Key Encipherment
    Digital Signature|GeneralPurposeTemplate| +| SCEP Profile Key usage| NDES Registry Value Name | +| :-------------------: | :----------------------: | +| Digital Signature | SignatureTemplate | +| Key Encipherment | EncryptionTemplate | +| Key Encipherment
    Digital Signature | GeneralPurposeTemplate | Ideally, you should match the certificate request with registry value name to keep the configuration intuitive (encryption certificates use the encryptionTemplate, signature certificates use the signature template, etc.). A result of this intuitive design is the potential exponential growth in NDES server. Imagine an organization that needs to issue nine unique signature certificates across their enterprise. - If the need arises, you can configure a signature certificate in the encryption registry value name or an encryption certificate in the signature registry value to maximize the use of your NDES infrastructure. This unintuitive design requires current and accurate documentation of the configuration to ensure the SCEP certificate profile is configured to enroll the correct certificate, regardless of the actual purpose. Each organization needs to balance ease of configuration and administration with additional NDES infrastructure and the management overhead that comes with it. +If the need arises, you can configure a signature certificate in the encryption registry value name or an encryption certificate in the signature registry value to maximize the use of your NDES infrastructure. This unintuitive design requires current and accurate documentation of the configuration to ensure the SCEP certificate profile is configured to enroll the correct certificate, regardless of the actual purpose. Each organization needs to balance ease of configuration and administration with additional NDES infrastructure and the management overhead that comes with it. Sign-in to the NDES Server with _local administrator_ equivalent credentials. 1. Open an elevated command prompt. 2. Using the table above, decide which registry value name you will use to request Windows Hello for Business authentication certificates for Azure AD joined devices. -3. Type the following command
    -```reg add HKLM\Software\Microsoft\Cryptography\MSCEP /v [registryValueName] /t REG_SZ /d [certificateTemplateName]```
    -where **registryValueName** is one of the three value names from the above table and where **certificateTemplateName** is the name of the certificate template you created for Windows Hello for Business Azure AD joined devices. Example:
    -```reg add HKLM\Software\Microsoft\Cryptography\MSCEP /v SignatureTemplate /t REG_SZ /d AADJWHFBAuthentication```
    +3. Type the following command: + ``` + reg add HKLM\Software\Microsoft\Cryptography\MSCEP /v [registryValueName] /t REG_SZ /d [certificateTemplateName] + ``` + where **registryValueName** is one of the three value names from the above table and where **certificateTemplateName** is the name of the certificate template you created for Windows Hello for Business Azure AD joined devices. Example: + ``` + reg add HKLM\Software\Microsoft\Cryptography\MSCEP /v SignatureTemplate /t REG_SZ /d AADJWHFBAuthentication + ``` 4. Type **Y** when the command asks for permission to overwrite the existing value. 5. Close the command prompt. > [!IMPORTANT] -> Use the **name** of the certificate template; not the **display name**. The certificate template name does not include spaces. You can view the certificate names by looking at the **General** tab of the certificate template's properties in the **Certificates Templates** management console (certtmpl.msc). +> Use the **name** of the certificate template; not the **display name**. The certificate template name does not include spaces. You can view the certificate names by looking at the **General** tab of the certificate template's properties in the **Certificates Templates** management console (`certtmpl.msc`). ### Create a Web Application Proxy for the internal NDES URL. Certificate enrollment for Azure AD joined devices occurs over the Internet. As a result, the internal NDES URLs must be accessible externally. You can do this easily and securely using Azure Active Directory Application Proxy. Azure AD Application Proxy provides single sign-on and secure remote access for web applications hosted on-premises, such as Network Device Enrollment Services. -Ideally, you configure your Microsoft Intune SCEP certificate profile to use multiple external NDES URLs. This enables Microsoft Intune to round-robin load balance the certificate requests to identically configured NDES Servers (each NDES server can accommodate approximately 300 concurrent requests). Microsoft Intune sends these requests to Azure AD Application Proxies. +Ideally, you configure your Microsoft Intune SCEP certificate profile to use multiple external NDES URLs. This enables Microsoft Intune to round-robin load balance the certificate requests to identically configured NDES Servers (each NDES server can accommodate approximately 300 concurrent requests). Microsoft Intune sends these requests to Azure AD Application Proxies. Azure AD Application proxies are serviced by lightweight Application Proxy Connector agents. These agents are installed on your on-premises, domain joined devices and make authenticated secure outbound connection to Azure, waiting to process requests from Azure AD Application Proxies. You can create connector groups in Azure Active Directory to assign specific connectors to service specific applications. @@ -395,7 +410,7 @@ Sign-in a workstation with access equivalent to a _domain user_. ![Azure Application Proxy Connectors](images/aadjcert/azureconsole-applicationproxy-connectors-empty.png) 5. Sign-in the computer that will run the connector with access equivalent to a _domain user_. > [!IMPORTANT] - > Install a minimum of two Azure Active Directory Proxy connectors for each NDES Application Proxy. Strategtically locate Azure AD application proxy connectors throughout your organization to ensure maximum availablity. Remember, devices running the connector must be able to communicate with Azure and the on-premises NDES servers. + > Install a minimum of two Azure Active Directory Proxy connectors for each NDES Application Proxy. Strategically locate Azure AD application proxy connectors throughout your organization to ensure maximum availability. Remember, devices running the connector must be able to communicate with Azure and the on-premises NDES servers. 6. Start **AADApplicationProxyConnectorInstaller.exe**. 7. Read the license terms and then select **I agree to the license terms and conditions**. Click **Install**. @@ -412,9 +427,9 @@ Sign-in a workstation with access equivalent to a _domain user_. 1. Sign-in to the [Azure Portal](https://portal.azure.com/) with access equivalent to **Global Administrator**. 2. Select **All Services**. Type **Azure Active Directory** to filter the list of services. Under **SERVICES**, Click **Azure Active Directory**. 3. Under **MANAGE**, click **Application proxy**. -![Azure Application Proxy Connector groups](images/aadjcert/azureconsole-applicationproxy-connectors-default.png) + ![Azure Application Proxy Connector groups](images/aadjcert/azureconsole-applicationproxy-connectors-default.png) 4. Click **New Connector Group**. Under **Name**, type **NDES WHFB Connectors**. -![Azure Application New Connector Group](images/aadjcert/azureconsole-applicationproxy-connectors-newconnectorgroup.png) + ![Azure Application New Connector Group](images/aadjcert/azureconsole-applicationproxy-connectors-newconnectorgroup.png) 5. Select each connector agent in the **Connectors** list that will service Windows Hello for Business certificate enrollment requests. 6. Click **Save**. @@ -426,18 +441,18 @@ Sign-in a workstation with access equivalent to a _domain user_. 3. Under **MANAGE**, click **Application proxy**. 4. Click **Configure an app**. 5. Under **Basic Settings** next to **Name**, type **WHFB NDES 01**. Choose a name that correlates this Azure AD Application Proxy setting with the on-premises NDES server. Each NDES server must have its own Azure AD Application Proxy as two NDES servers cannot share the same internal URL. -6. Next to **Internal Url**, type the internal, fully qualified DNS name of the NDES server associated with this Azure AD Application Proxy. For example, https://ndes.corp.mstepdemo.net). You need to match the primary host name (AD Computer Account name) of the NDES server, and prefix the URL with **https**. -7. Under **Internal Url**, select **https://** from the first list. In the text box next to **https://**, type the hostname you want to use as your external hostname for the Azure AD Application Proxy. In the list next to the hostname you typed, select a DNS suffix you want to use externally for the Azure AD Application Proxy. It is recommended to use the default, -[tenantName].msapproxy.net where **[tenantName]** is your current Azure Active Directory tenant name (-mstephendemo.msappproxy.net). +6. Next to **Internal URL**, type the internal, fully qualified DNS name of the NDES server associated with this Azure AD Application Proxy. For example, https://ndes.corp.mstepdemo.net). You need to match the primary host name (AD Computer Account name) of the NDES server, and prefix the URL with **https**. +7. Under **Internal URL**, select **https://** from the first list. In the text box next to **https://**, type the hostname you want to use as your external hostname for the Azure AD Application Proxy. In the list next to the hostname you typed, select a DNS suffix you want to use externally for the Azure AD Application Proxy. It is recommended to use the default, -[tenantName].msapproxy.net where **[tenantName]** is your current Azure Active Directory tenant name (-mstephendemo.msappproxy.net). ![Azure NDES Application Proxy Configuration](images/aadjcert/azureconsole-appproxyconfig.png) 8. Select **Passthrough** from the **Pre Authentication** list. 9. Select **NDES WHFB Connectors** from the **Connector Group** list. 10. Under **Additional Settings**, select **Default** from **Backend Application Timeout**. Under the **Translate URLLs In** section, select **Yes** next to **Headers** and select **No** next to **Application Body**. 11. Click **Add**. 12. Sign-out of the Azure Portal. + > [!IMPORTANT] > Write down the internal and external URLs. You will need this information when you enroll the NDES-Intune Authentication certificate. - ### Enroll the NDES-Intune Authentication certificate This task enrolls a client and server authentication certificate used by the Intune connector and the NDES server. @@ -449,8 +464,8 @@ Sign-in the NDES server with access equivalent to _local administrators_. 4. Click **Next** on the **Before You Begin** page. 5. Click **Next** on the **Select Certificate Enrollment Policy** page. 6. On the **Request Certificates** page, Select the **NDES-Intune Authentication** check box. -7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link - ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link](images/aadjcert/ndes-TLS-Cert-Enroll-subjectNameWithExternalName.png) +7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link + ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link](images/aadjcert/ndes-TLS-Cert-Enroll-subjectNameWithExternalName.png) 8. Under **Subject name**, select **Common Name** from the **Type** list. Type the internal URL used in the previous task (without the https://, for example **ndes.corp.mstepdemo.net**) and then click **Add**. 9. Under **Alternative name**, select **DNS** from the **Type** list. Type the internal URL used in the previous task (without the https://, for example **ndes.corp.mstepdemo.net**). Click **Add**. Type the external URL used in the previous task (without the https://, for example **ndes-mstephendemo.msappproxy.net**). Click **Add**. Click **OK** when finished. 9. Click **Enroll** @@ -462,44 +477,46 @@ This task configures the Web Server role on the NDES server to use the server au Sign-in the NDES server with access equivalent to _local administrator_. 1. Start **Internet Information Services (IIS) Manager** from **Administrative Tools**. -2. Expand the node that has the name of the NDES server. Expand **Sites** and select **Default Web Site**. -![NDES IIS Console](images/aadjcert/ndes-iis-console.png) +2. Expand the node that has the name of the NDES server. Expand **Sites** and select **Default Web Site**. + ![NDES IIS Console](images/aadjcert/ndes-iis-console.png) 3. Click **Bindings...*** under **Actions**. Click **Add**. -![NDES IIS Console](images/aadjcert/ndes-iis-bindings.png) + ![NDES IIS Console](images/aadjcert/ndes-iis-bindings.png) 4. Select **https** from **Type**. Confirm the value for **Port** is **443**. 5. Select the certificate you previously enrolled from the **SSL certificate** list. Select **OK**. -![NDES IIS Console](images/aadjcert/ndes-iis-bindings-add-443.png) -6. Select **http** from the **Site Bindings** list. Click **Remove**. + ![NDES IIS Console](images/aadjcert/ndes-iis-bindings-add-443.png) +6. Select **http** from the **Site Bindings** list. Click **Remove**. 7. Click **Close** on the **Site Bindings** dialog box. -8. Close **Internet Information Services (IIS) Manager**. +8. Close **Internet Information Services (IIS) Manager**. ### Verify the configuration This task confirms the TLS configuration for the NDES server. Sign-in the NDES server with access equivalent to _local administrator_. -#### Disable Internet Explorer Enhanced Security Configuration +#### Disable Internet Explorer Enhanced Security Configuration 1. Open **Server Manager**. Click **Local Server** from the navigation pane. 2. Click **On** next to **IE Enhanced Security Configuration** in the **Properties** section. 3. In the **Internet Explorer Enhanced Security Configuration** dialog, under **Administrators**, select **Off**. Click **OK**. 4. Close **Server Manager**. #### Test the NDES web server -1. Open **Internet Explorer**. -2. In the navigation bar, type -```https://[fqdnHostName]/certsrv/mscep/mscep.dll``` -where **[fqdnHostName]** is the fully qualified internal DNS host name of the NDES server. +1. Open **Internet Explorer**. +2. In the navigation bar, type + ``` + https://[fqdnHostName]/certsrv/mscep/mscep.dll + ``` + where **[fqdnHostName]** is the fully qualified internal DNS host name of the NDES server. A web page similar to the following should appear in your web browser. If you do not see similar page, or you get a **503 Service unavailable**, ensure the NDES Service account as the proper user rights. You can also review the application event log for events with the **NetworkDeviceEnrollmentSerice** source. ![NDES IIS Console](images/aadjcert/ndes-https-website-test-01.png) -Confirm the web site uses the server authentication certificate. +Confirm the web site uses the server authentication certificate. ![NDES IIS Console](images/aadjcert/ndes-https-website-test-01-show-cert.png) ## Configure Network Device Enrollment Services to work with Microsoft Intune -You have successfully configured the Network Device Enrollment Services. You must now modify the configuration to work with the Intune Certificate Connector. In this task, you will enable the NDES server and http.sys to handle long URLs. +You have successfully configured the Network Device Enrollment Services. You must now modify the configuration to work with the Intune Certificate Connector. In this task, you will enable the NDES server and http.sys to handle long URLs. - Configure NDES to support long URLs @@ -510,7 +527,7 @@ Sign-in the NDES server with access equivalent to _local administrator_. 1. Start **Internet Information Services (IIS) Manager** from **Administrative Tools**. 2. Expand the node that has the name of the NDES server. Expand **Sites** and select **Default Web Site**. 3. In the content pane, double-click **Request Filtering**. Click **Edit Feature Settings...** in the action pane. -![Intune NDES Request filtering](images/aadjcert/NDES-IIS-RequestFiltering.png) + ![Intune NDES Request filtering](images/aadjcert/NDES-IIS-RequestFiltering.png) 4. Select **Allow unlisted file name extensions**. 5. Select **Allow unlisted verbs**. 6. Select **Allow high-bit characters**. @@ -521,21 +538,23 @@ Sign-in the NDES server with access equivalent to _local administrator_. #### Configure Parameters for HTTP.SYS 1. Open an elevated command prompt. -2. Run the following commands
    -```reg add HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters /v MaxFieldLength /t REG_DWORD /d 65534```
    -```reg add HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters /v MaxRequestBytes /t REG_DWORD /d 65534```
    +2. Run the following commands: + ``` + reg add HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters /v MaxFieldLength /t REG_DWORD /d 65534 + reg add HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters /v MaxRequestBytes /t REG_DWORD /d 65534 + ``` 3. Restart the NDES server. ## Download, Install and Configure the Intune Certificate Connector -The Intune Certificate Connector application enables Microsoft Intune to enroll certificates using your on-premises PKI for users on devices managed by Microsoft Intune. +The Intune Certificate Connector application enables Microsoft Intune to enroll certificates using your on-premises PKI for users on devices managed by Microsoft Intune. -### Download Intune Certificate Connector +### Download Intune Certificate Connector Sign-in a workstation with access equivalent to a _domain user_. 1. Sign-in to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/). 2. Select **Tenant administration** > **Connectors and tokens** > **Certificate connectors** > **Add**. 3. Click **Download the certificate connector software** under the **Install Certificate Connectors** section. -![Intune Certificate Authority](images/aadjcert/profile01.png) + ![Intune Certificate Authority](images/aadjcert/profile01.png) 4. Save the downloaded file (NDESConnectorSetup.exe) to a location accessible from the NDES server. 5. Sign-out of the Microsoft Endpoint Manager admin center. @@ -544,30 +563,33 @@ Sign-in the NDES server with access equivalent to _domain administrator_. 1. Copy the Intune Certificate Connector Setup (NDESConnectorSetup.exe) downloaded in the previous task locally to the NDES server. 2. Run **NDESConnectorSetup.exe** as an administrator. If the setup shows a dialog that reads **Microsoft Intune NDES Connector requires HTTP Activation**, ensure you started the application as an administrator, then check HTTP Activation is enabled on the NDES server. -3. On the **Microsoft Intune** page, click **Next**. +3. On the **Microsoft Intune** page, click **Next**. ![Intune Connector Install 01](images/aadjcert/intunecertconnectorinstall-01.png) 4. Read the **End User License Agreement**. Click **Next** to accept the agreement and to proceed with the installation. 5. On the **Destination Folder** page, click **Next**. 6. On the **Installation Options** page, select **SCEP and PFX Profile Distribution** and click **Next**. ![Intune Connector Install 03](images/aadjcert/intunecertconnectorinstall-03.png) -7. On the **Client certificate for Microsoft Intune** page, Click **Select**. Select the certificate previously enrolled for the NDES server. Click **Next**. +7. On the **Client certificate for Microsoft Intune** page, Click **Select**. Select the certificate previously enrolled for the NDES server. Click **Next**. ![Intune Connector Install 05](images/aadjcert/intunecertconnectorinstall-05.png) + > [!NOTE] > The **Client certificate for Microsoft Intune** page does not update after selecting the client authentication certificate. However, the application rembers the selection and shows it in the next page. 8. On the **Client certificate for the NDES Policy Module** page, verify the certificate information and then click **Next**. 9. ON the **Ready to install Microsoft Intune Connector** page. Click **Install**. ![Intune Connector Install 06](images/aadjcert/intunecertconnectorinstall-06.png) + > [!NOTE] > You can review the results of the install using the **SetupMsi.log** file located in the **C:\\NDESConnectorSetupMsi** folder -10. When the installation completes, select **Launch Intune Connector** and click Finish. Proceed to the Configure the Intune Certificate Connector task. +10. When the installation completes, select **Launch Intune Connector** and click Finish. Proceed to the Configure the Intune Certificate Connector task. ![Intune Connector install 07](images/aadjcert/intunecertconnectorinstall-07.png) ### Configure the Intune Certificate Connector Sign-in the NDES server with access equivalent to _domain administrator_. 1. The **NDES Connector** user interface should be open from the last task. + > [!NOTE] > If the **NDES Connector** user interface is not open, you can start it from **\\NDESConnectorUI\NDESConnectorUI.exe**. @@ -576,10 +598,11 @@ Sign-in the NDES server with access equivalent to _domain administrator_. 3. Click **Sign-in**. Type credentials for your Intune administrator, or tenant administrator that has the **Global Administrator** directory role. ![Intune Certificate Connector Configuration 02](images/aadjcert/intunecertconnectorconfig-02.png) - > [!IMPORTANT] - > The user account must have a valid Intune licenese assigned. If the user account does not have a valid Intune license, the sign-in fails. -4. Optionally, you can configure the NDES Connector for certificate revocation. If you want to do this, continue to the next task. Otherwise, Click **Close**, restart the **Intune Connector Service** and the **World Wide Web Publishing Service**, and skip the next task. + > [!IMPORTANT] + > The user account must have a valid Intune license assigned. If the user account does not have a valid Intune license, the sign-in fails. + +4. Optionally, you can configure the NDES Connector for certificate revocation. If you want to do this, continue to the next task. Otherwise, Click **Close**, restart the **Intune Connector Service** and the **World Wide Web Publishing Service**, and skip the next task. ### Configure the NDES Connector for certificate revocation (**Optional**) @@ -591,7 +614,7 @@ Sign-in the certificate authority used by the NDES Connector with access equival 1. Start the **Certification Authority** management console. 2. In the navigation pane, right-click the name of the certificate authority and select **Properties**. 3. Click the **Security** tab. Click **Add**. In **Enter the object names to select** box, type **NDESSvc** (or the name you gave the NDES Service account). Click *Check Names*. Click **OK**. Select the NDES Service account from the **Group or user names** list. Select **Allow** for the **Issue and Manage Certificates** permission. Click **OK**. -![Configure Intune certificate revocation 02](images/aadjcert/intuneconfigcertrevocation-02.png) + ![Configure Intune certificate revocation 02](images/aadjcert/intuneconfigcertrevocation-02.png) 4. Close the **Certification Authority** #### Enable the NDES Connector for certificate revocation @@ -599,22 +622,26 @@ Sign-in the NDES server with access equivalent to _domain administrator_. 1. Open the **NDES Connector** user interface (**\\NDESConnectorUI\NDESConnectorUI.exe**). 2. Click the **Advanced** tab. Select **Specify a different account username and password**. TYpe the NDES service account username and password. Click **Apply**. Click **OK** to close the confirmation dialog box. Click **Close**. -![Intune Connector cert revocation configuration 04](images/aadjcert/intunecertconnectorconfig-04.png) + ![Intune Connector cert revocation configuration 04](images/aadjcert/intunecertconnectorconfig-04.png) 3. Restart the **Intune Connector Service** and the **World Wide Web Publishing Service**. ### Test the NDES Connector Sign-in the NDES server with access equivalent to _domain admin_. 1. Open a command prompt. -2. Type the following command to confirm the NDES Connector's last connection time is current.
    -```reg query hklm\software\Microsoft\MicrosoftIntune\NDESConnector\ConnectionStatus```
    +2. Type the following command to confirm the NDES Connector's last connection time is current. + ``` + reg query hklm\software\Microsoft\MicrosoftIntune\NDESConnector\ConnectionStatus + ``` 3. Close the command prompt. 4. Open **Internet Explorer**. -5. In the navigation bar, type
    -```https://[fqdnHostName]/certsrv/mscep/mscep.dll```
    -where **[fqdnHostName]** is the fully qualified internal DNS host name of the NDES server.
    -A web page showing a 403 error (similar to the following) should appear in your web browser. If you do not see similar page, or you get a **503 Service unavailable**, ensure the NDES Service account as the proper user rights. You can also review the application event log for events with the **NetworkDeviceEnrollmentSerice** source. -![NDES web site test after Intune Certificate Connector](images/aadjcert/ndes-https-website-test-after-intune-connector.png) +5. In the navigation bar, type: + ``` + https://[fqdnHostName]/certsrv/mscep/mscep.dll + ``` + where **[fqdnHostName]** is the fully qualified internal DNS host name of the NDES server. + A web page showing a 403 error (similar to the following) should appear in your web browser. If you do not see similar page, or you get a **503 Service unavailable**, ensure the NDES Service account as the proper user rights. You can also review the application event log for events with the **NetworkDeviceEnrollmentSerice** source. + ![NDES web site test after Intune Certificate Connector](images/aadjcert/ndes-https-website-test-after-intune-connector.png) 6. Using **Server Manager**, enable **Internet Explorer Enhanced Security Configuration**. ## Create and Assign a Simple Certificate Enrollment Protocol (SCEP) Certificate Profile @@ -629,7 +656,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 5. Under **Group Name**, type the name of the group. For example, **AADJ WHFB Certificate Users**. 6. Provide a **Group description**, if applicable. 7. Select **Assigned** from the **Membership type** list. -![Azure AD new group creation](images/aadjcert/azureadcreatewhfbcertgroup.png) + ![Azure AD new group creation](images/aadjcert/azureadcreatewhfbcertgroup.png) 8. Click **Members**. Use the **Select members** pane to add members to this group. When finished click **Select**. 9. Click **Create**. @@ -646,6 +673,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 7. Next to **Description**, provide a description meaningful for your environment, then select **Next**. 8. Select **User** as a certificate type. 9. Configure **Certificate validity period** to match your organization. + > [!IMPORTANT] > Remember that you need to configure your certificate authority to allow Microsoft Intune to configure certificate validity. @@ -669,7 +697,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 3. Click **WHFB Certificate Enrollment**. 4. Select **Properties**, and then click **Edit** next to the **Assignments** section. 5. In the **Assignments** pane, select **Selected Groups** from the **Assign to** list. Click **Select groups to include**. -![WHFB SCEP Profile Assignment](images/aadjcert/profile04.png) + ![WHFB SCEP Profile Assignment](images/aadjcert/profile04.png) 6. Select the **AADJ WHFB Certificate Users** group. Click **Select**. 7. Click **Review + Save**, and then **Save**. @@ -679,7 +707,7 @@ You have successfully completed the configuration. Add users that need to enrol > [!div class="checklist"] > * Requirements > * Prepare Azure AD Connect -> * Prepare the Network Device Enrollment Services (NDES) Service Acccount +> * Prepare the Network Device Enrollment Services (NDES) Service Account > * Prepare Active Directory Certificate Authority > * Install and Configure the NDES Role > * Configure Network Device Enrollment Services to work with Microsoft Intune From 3c65f4b71a4ca4c3613ace1822a29593f4d940d3 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 4 Jan 2021 16:52:22 -0800 Subject: [PATCH 034/206] Updated the levels for the WDAC Wizard topic The WDAC Wizard articles are now parented to "Create your initial WDAC policy" --- .../windows-defender-application-control/TOC.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/TOC.md b/windows/security/threat-protection/windows-defender-application-control/TOC.md index b29a8d0e37..a366bf6b41 100644 --- a/windows/security/threat-protection/windows-defender-application-control/TOC.md +++ b/windows/security/threat-protection/windows-defender-application-control/TOC.md @@ -21,11 +21,11 @@ ##### [Create a WDAC policy for fully-managed devices](create-wdac-policy-for-fully-managed-devices.md) ##### [Create a WDAC policy for fixed-workload devices](create-initial-default-policy.md) ##### [Microsoft recommended block rules](microsoft-recommended-block-rules.md) -### [Using the WDAC Wizard tool](wdac-wizard.md) -#### [Create a base WDAC policy](wdac-wizard-create-base-policy.md) -#### [Create a supplemental WDAC policy](wdac-wizard-create-supplemental-policy.md) -#### [Editing a WDAC policy](wdac-wizard-editing-policy.md) -#### [Merging multiple WDAC policies](wdac-wizard-merging-policies.md) +#### [Using the WDAC Wizard tool](wdac-wizard.md) +##### [Create a base WDAC policy with the Wizard](wdac-wizard-create-base-policy.md) +##### [Create a supplemental WDAC policy with the Wizard](wdac-wizard-create-supplemental-policy.md) +##### [Editing a WDAC policy with the Wizard](wdac-wizard-editing-policy.md) +##### [Merging multiple WDAC policies with the Wizard](wdac-wizard-merging-policies.md) ## [Windows Defender Application Control deployment guide](windows-defender-application-control-deployment-guide.md) From b92c3c2028832ee81c77106bc049988a3d82a0b1 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 4 Jan 2021 17:03:05 -0800 Subject: [PATCH 035/206] Updated the definition of the 'Wizard' as the first reference to the wizard --- .../windows-defender-application-control/wdac-wizard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md index 4e765e5339..399ff347f0 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md @@ -25,7 +25,7 @@ ms.date: 10/14/2020 - Windows 10 - Windows Server 2016 and above -This article describes the supported scenarios for the Windows Defender Application Control (WDAC) policy Wizard. The Wizard was built to provide security architects, security and system administrators with a more user-friendly means to create, edit, and merge WDAC policies. The Wizard desktop application uses the [ConfigCI PowerShell Cmdlets](https://docs.microsoft.com/powershell/module/configci/?view=win10-ps) in the background so the output policy of the Wizard and PowerShell cmdlets is identical. +The Windows Defender Application Control (WDAC) policy Wizard is an open source Windows desktop application written in C# and bundled as an MSIX pacakge. The Wizard was built to provide security architects, security and system administrators with a more user-friendly means to create, edit, and merge WDAC policies. The Wizard desktop application uses the [ConfigCI PowerShell Cmdlets](https://docs.microsoft.com/powershell/module/configci/?view=win10-ps) in the backend so the output policy of the Wizard and PowerShell cmdlets is identical. ## Downloading the application From a66d47b32a6d637cdcea3a823c9da0577323836e Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Tue, 5 Jan 2021 10:20:55 +0530 Subject: [PATCH 036/206] typo correction as per the user report #8904, so I corrected the word cashed to cached --- windows/security/threat-protection/auditing/event-4624.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/event-4624.md b/windows/security/threat-protection/auditing/event-4624.md index b310cd06ca..637a86a151 100644 --- a/windows/security/threat-protection/auditing/event-4624.md +++ b/windows/security/threat-protection/auditing/event-4624.md @@ -156,7 +156,7 @@ This event generates when a logon session is created (on destination machine). I | `9` | `NewCredentials` | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. | | `10` | `RemoteInteractive` | A user logged on to this computer remotely using Terminal Services or Remote Desktop. | | `11` | `CachedInteractive` | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. | -| `12` | `CashedRemoteInteractive` | Same as RemoteInteractive. This is used for internal auditing. | +| `12` | `CachedRemoteInteractive` | Same as RemoteInteractive. This is used for internal auditing. | | `13` | `CachedUnlock` | Workstation logon. | - **Restricted Admin Mode** \[Version 2\] \[Type = UnicodeString\]**:** Only populated for **RemoteInteractive** logon type sessions. This is a Yes/No flag indicating if the credentials provided were passed using Restricted Admin mode. Restricted Admin mode was added in Win8.1/2012R2 but this flag was added to the event in Win10. From 16cd7c964c3ba94b8dba60d4cf82b17f931dcfb3 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Tue, 5 Jan 2021 10:04:34 +0100 Subject: [PATCH 037/206] missing period dot ( . ) in line 348 Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-cert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index e8dc2df8f2..23c62b474a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -345,7 +345,7 @@ Sign-in to the certificate authority or management workstations with an _Enterpr ![NDES Installation Credentials](images/aadjcert/ndesconfig01.png) 3. On the **Role Services** page, select **Network Device Enrollment Service** and then click **Next** ![NDES Role Services](images/aadjcert/ndesconfig02.png) -4. On the **Service Account for NDES** page, select **Specify service account (recommended)**. Click **Select...** Type the user name and password for the NDES service account in the **Windows Security** dialog box. Click **Next**. +4. On the **Service Account for NDES** page, select **Specify service account (recommended)**. Click **Select...**. Type the user name and password for the NDES service account in the **Windows Security** dialog box. Click **Next**. ![NDES Service Account for NDES](images/aadjcert/ndesconfig03b.png) 5. On the **CA for NDES** page, select **CA name**. Click **Select...**. Select the issuing certificate authority from which the NDES server requests certificates. Click **Next**. ![NDES CA selection](images/aadjcert/ndesconfig04.png) From fef05431b3baec7f5f13282596ad649e7150e1a0 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Tue, 5 Jan 2021 10:06:08 +0100 Subject: [PATCH 038/206] missing plural S in "three certificate template" (line 359) Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-cert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 23c62b474a..82d0d79705 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -356,7 +356,7 @@ Sign-in to the certificate authority or management workstations with an _Enterpr 8. Click **Close** after the configuration completes. #### Configure Certificate Templates on NDES -A single NDES server can request a maximum of three certificate template. The NDES server determines which certificate to issue based on the incoming certificate request that is assigned in the Microsoft Intune SCEP certificate profile. The Microsoft Intune SCEP certificate profile has three values. +A single NDES server can request a maximum of three certificate templates. The NDES server determines which certificate to issue based on the incoming certificate request that is assigned in the Microsoft Intune SCEP certificate profile. The Microsoft Intune SCEP certificate profile has three values. * Digital Signature * Key Encipherment * Key Encipherment, Digital Signature From 8fa226d4f0eabf152c01c7ff57736de5d6819f88 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Tue, 5 Jan 2021 10:10:47 +0100 Subject: [PATCH 039/206] multiple grammar issues in one sentence (line 364) - translate -> translates - provide -> provided - correspond -> corresponding - belows -> below - value to -> values of - name -> names Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-cert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 82d0d79705..e41296761c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -361,7 +361,7 @@ A single NDES server can request a maximum of three certificate templates. The * Key Encipherment * Key Encipherment, Digital Signature -Each value maps to a registry value name in the NDES server. The NDES server translate an incoming SCEP provide value into the correspond certificate template. The table belows shows the SCEP profile value to the NDES certificate template registry value name +Each value maps to a registry value name in the NDES server. The NDES server translates an incoming SCEP provided value into the corresponding certificate template. The table below shows the SCEP profile values of the NDES certificate template registry value names. | SCEP Profile Key usage| NDES Registry Value Name | | :-------------------: | :----------------------: | From d775c3fc4ddb8d1466a548d4de3e66feddde7760 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Tue, 5 Jan 2021 10:15:06 +0100 Subject: [PATCH 040/206] grammar & template reference naming - missing definite article, 2 occurrences (line 372) - encryptionTemplate -> encryption template Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-cert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index e41296761c..5b3a471495 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -369,7 +369,7 @@ Each value maps to a registry value name in the NDES server. The NDES server tr | Key Encipherment | EncryptionTemplate | | Key Encipherment
    Digital Signature | GeneralPurposeTemplate | -Ideally, you should match the certificate request with registry value name to keep the configuration intuitive (encryption certificates use the encryptionTemplate, signature certificates use the signature template, etc.). A result of this intuitive design is the potential exponential growth in NDES server. Imagine an organization that needs to issue nine unique signature certificates across their enterprise. +Ideally, you should match the certificate request with the registry value name to keep the configuration intuitive (encryption certificates use the encryption template, signature certificates use the signature template, etc.). A result of this intuitive design is the potential exponential growth in the NDES server. Imagine an organization that needs to issue nine unique signature certificates across their enterprise. If the need arises, you can configure a signature certificate in the encryption registry value name or an encryption certificate in the signature registry value to maximize the use of your NDES infrastructure. This unintuitive design requires current and accurate documentation of the configuration to ensure the SCEP certificate profile is configured to enroll the correct certificate, regardless of the actual purpose. Each organization needs to balance ease of configuration and administration with additional NDES infrastructure and the management overhead that comes with it. From bbd85b903da1ce62f7a9d6ada6ed86b5ab1125a2 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Tue, 5 Jan 2021 10:16:47 +0100 Subject: [PATCH 041/206] URLLs double L typo correction (line 449) Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-cert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 5b3a471495..31b2fc5946 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -446,7 +446,7 @@ Sign-in a workstation with access equivalent to a _domain user_. ![Azure NDES Application Proxy Configuration](images/aadjcert/azureconsole-appproxyconfig.png) 8. Select **Passthrough** from the **Pre Authentication** list. 9. Select **NDES WHFB Connectors** from the **Connector Group** list. -10. Under **Additional Settings**, select **Default** from **Backend Application Timeout**. Under the **Translate URLLs In** section, select **Yes** next to **Headers** and select **No** next to **Application Body**. +10. Under **Additional Settings**, select **Default** from **Backend Application Timeout**. Under the **Translate URLs In** section, select **Yes** next to **Headers** and select **No** next to **Application Body**. 11. Click **Add**. 12. Sign-out of the Azure Portal. From 49ec0a4a5cef7476eae87e8eb11c73bd2d04ad0e Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Tue, 5 Jan 2021 10:18:13 +0100 Subject: [PATCH 042/206] missing indefinite article, missing noun (line 510) Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-cert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 31b2fc5946..bd48c6427b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -507,7 +507,7 @@ Sign-in the NDES server with access equivalent to _local administrator_. ``` where **[fqdnHostName]** is the fully qualified internal DNS host name of the NDES server. -A web page similar to the following should appear in your web browser. If you do not see similar page, or you get a **503 Service unavailable**, ensure the NDES Service account as the proper user rights. You can also review the application event log for events with the **NetworkDeviceEnrollmentSerice** source. +A web page similar to the following should appear in your web browser. If you do not see a similar page, or you get a **503 Service unavailable** message, ensure the NDES Service account has the proper user rights. You can also review the application event log for events with the **NetworkDeviceEnrollmentSerice** source. ![NDES IIS Console](images/aadjcert/ndes-https-website-test-01.png) From e3cbee4767dfa592313d17f3e5079b1fb322191d Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Tue, 5 Jan 2021 10:18:54 +0100 Subject: [PATCH 043/206] missing period dot ( . ) (line 583) Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-cert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index bd48c6427b..b72a7ff097 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -580,7 +580,7 @@ Sign-in the NDES server with access equivalent to _domain administrator_. ![Intune Connector Install 06](images/aadjcert/intunecertconnectorinstall-06.png) > [!NOTE] - > You can review the results of the install using the **SetupMsi.log** file located in the **C:\\NDESConnectorSetupMsi** folder + > You can review the results of the install using the **SetupMsi.log** file located in the **C:\\NDESConnectorSetupMsi** folder. 10. When the installation completes, select **Launch Intune Connector** and click Finish. Proceed to the Configure the Intune Certificate Connector task. ![Intune Connector install 07](images/aadjcert/intunecertconnectorinstall-07.png) From 02d5692cc1c2c9b73284feded43fd68893f1cd6d Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Tue, 5 Jan 2021 10:20:22 +0100 Subject: [PATCH 044/206] Double capitalized letter word typo (line 624) Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-cert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index b72a7ff097..7a58e40fde 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -621,7 +621,7 @@ Sign-in the certificate authority used by the NDES Connector with access equival Sign-in the NDES server with access equivalent to _domain administrator_. 1. Open the **NDES Connector** user interface (**\\NDESConnectorUI\NDESConnectorUI.exe**). -2. Click the **Advanced** tab. Select **Specify a different account username and password**. TYpe the NDES service account username and password. Click **Apply**. Click **OK** to close the confirmation dialog box. Click **Close**. +2. Click the **Advanced** tab. Select **Specify a different account username and password**. Type the NDES service account username and password. Click **Apply**. Click **OK** to close the confirmation dialog box. Click **Close**. ![Intune Connector cert revocation configuration 04](images/aadjcert/intunecertconnectorconfig-04.png) 3. Restart the **Intune Connector Service** and the **World Wide Web Publishing Service**. From c1947a84ad9f4b8d0ad99a46cf3a591d3e14f4a6 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Tue, 5 Jan 2021 10:22:20 +0100 Subject: [PATCH 045/206] verb typo correction, add missing noun (line 643) Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-cert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 7a58e40fde..88cac79cd9 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -640,7 +640,7 @@ Sign-in the NDES server with access equivalent to _domain admin_. https://[fqdnHostName]/certsrv/mscep/mscep.dll ``` where **[fqdnHostName]** is the fully qualified internal DNS host name of the NDES server. - A web page showing a 403 error (similar to the following) should appear in your web browser. If you do not see similar page, or you get a **503 Service unavailable**, ensure the NDES Service account as the proper user rights. You can also review the application event log for events with the **NetworkDeviceEnrollmentSerice** source. + A web page showing a 403 error (similar to the following) should appear in your web browser. If you do not see a similar page, or you get a **503 Service unavailable** message, ensure the NDES Service account has the proper user rights. You can also review the application event log for events with the **NetworkDeviceEnrollmentSerice** source. ![NDES web site test after Intune Certificate Connector](images/aadjcert/ndes-https-website-test-after-intune-connector.png) 6. Using **Server Manager**, enable **Internet Explorer Enhanced Security Configuration**. From 2ffc55bd3ec7dac166274a302a36b5e51e8c1dba Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Tue, 5 Jan 2021 10:24:36 +0100 Subject: [PATCH 046/206] verb form correction (line 69) - "need to" -> needed Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-cert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 88cac79cd9..ec87491d7d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -66,7 +66,7 @@ Successful authentication to on-premises resources using a certificate requires Most environments change the user principal name suffix to match the organization's external domain name (or vanity domain), which prevents the user principal name as a hint to locate a domain controller. Therefore, the certificate needs the user's on-premises distinguished name in the subject to properly locate a domain controller. -To include the on-premises distinguished name in the certificate's subject, Azure AD Connect must replicate the Active Directory **distinguishedName** attribute to the Azure Active Directory **onPremisesDistinguishedName** attribute. Azure AD Connect version 1.1.819 includes the proper synchronization rules need to for these attributes. +To include the on-premises distinguished name in the certificate's subject, Azure AD Connect must replicate the Active Directory **distinguishedName** attribute to the Azure Active Directory **onPremisesDistinguishedName** attribute. Azure AD Connect version 1.1.819 includes the proper synchronization rules needed for these attributes. ### Verify AAD Connect version Sign-in to computer running Azure AD Connect with access equivalent to _local administrator_. From 5671cfff44e143723262222d1a8c267621db9d1e Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Tue, 5 Jan 2021 10:25:51 +0100 Subject: [PATCH 047/206] missing definite article & infinitive marker (line 125) Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-cert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index ec87491d7d..4b4966566f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -122,7 +122,7 @@ Sign-in to a domain controller or management workstation with access equivalent > Configuring the service's account password to **Password never expires** may be more convenient, but it presents a security risk. Normal service account passwords should expire in accordance with the organizations user password expiration policy. Create a reminder to change the service account's password two weeks before it will expire. Share the reminder with others that are allowed to change the password to ensure the password is changed before it expires. ### Create the NDES Service User Rights Group Policy object -The Group Policy object ensures the NDES Service account has the proper user right assign all the NDES servers in the **NDES Servers** group. As you add new NDES servers to your environment and this group, the service account automatically receives the proper user rights through Group Policy. +The Group Policy object ensures the NDES Service account has the proper user right to assign all the NDES servers in the **NDES Servers** group. As you add new NDES servers to your environment and this group, the service account automatically receives the proper user rights through the Group Policy. Sign-in a domain controller or management workstations with _Domain Admin_ equivalent credentials. From f3f6450556f26cc071628c2dc1922f3ab4371135 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Tue, 5 Jan 2021 10:39:07 +0100 Subject: [PATCH 048/206] plural/singular noun correction (line 59) Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-cert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 4b4966566f..94c374762b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -56,7 +56,7 @@ The Network Device Enrollment Service (NDES) server role can issue up to three u - Encryption - Signature and Encryption -If you need to deploy more than three types of certificates to the Azure AD joined device, you need additional NDES servers. Alternatively, consider consolidating certificates templates to reduce the number of certificate templates. +If you need to deploy more than three types of certificates to the Azure AD joined device, you need additional NDES servers. Alternatively, consider consolidating certificate templates to reduce the number of certificate templates. ### Network Requirements All communication occurs securely over port 443. From 3cb16011e49b3fa777c0686188502faf821f7e70 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Tue, 5 Jan 2021 10:40:01 +0100 Subject: [PATCH 049/206] redundant double spacing inside sentence (line 142) Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-cert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 94c374762b..230e8fc1a3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -139,7 +139,7 @@ Sign-in a domain controller or management workstations with _Domain Admin_ equiv 11. Close the **Group Policy Management Editor**. ### Configure security for the NDES Service User Rights Group Policy object -The best way to deploy the **NDES Service User Rights** Group Policy object is to use security group filtering. This enables you to easily manage the computers that receive the Group Policy settings by adding them to a group. +The best way to deploy the **NDES Service User Rights** Group Policy object is to use security group filtering. This enables you to easily manage the computers that receive the Group Policy settings by adding them to a group. Sign-in to a domain controller or management workstation with access equivalent to _domain administrator_. From c89b7d07943895d7b6ba9d809b1ee99c4b1af4bd Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Tue, 5 Jan 2021 10:41:07 +0100 Subject: [PATCH 050/206] incorrect definite particle in front of proper noun (line 208) Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-cert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 230e8fc1a3..bd6bc2384e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -205,7 +205,7 @@ Sign-in to the issuing certificate authority or management workstations with _Do 10. Click on the **Apply** to save changes and close the console. ### Create an Azure AD joined Windows Hello for Business authentication certificate template -During Windows Hello for Business provisioning, Windows 10 requests an authentication certificate from the Microsoft Intune, which requests the authentication certificate on behalf of the user. This task configures the Windows Hello for Business authentication certificate template. You use the name of the certificate template when configuring the NDES Server. +During Windows Hello for Business provisioning, Windows 10 requests an authentication certificate from Microsoft Intune, which requests the authentication certificate on behalf of the user. This task configures the Windows Hello for Business authentication certificate template. You use the name of the certificate template when configuring the NDES Server. Sign in a certificate authority or management workstations with _Domain Admin equivalent_ credentials. From fa9ef702ed2ea255dae2a85454883ae416dddab2 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Tue, 5 Jan 2021 10:42:53 +0100 Subject: [PATCH 051/206] incorrect definite particle & conjunction comma (line 226) Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-cert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index bd6bc2384e..df2d14cdb3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -223,7 +223,7 @@ Sign in a certificate authority or management workstations with _Domain Admin eq 8. On the **Subject** tab, select **Supply in the request**. 9. On the **Request Handling** tab, select **Signature and encryption** from the **Purpose** list. Select the **Renew with same key** check box. Select **Enroll subject without requiring any user input**. 10. On the **Security** tab, click **Add**. Type **NDESSvc** in the **Enter the object names to select** text box and click **OK**. -12. Select **NDESSvc** from the **Group or users names** list. In the **Permissions for NDES Servers** section, select the **Allow** check box for the **Read**, **Enroll**. Clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. +12. Select **NDESSvc** from the **Group or users names** list. In the **Permissions for NDES Servers** section, select the **Allow** check box for **Read** and **Enroll**. Clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. 13. Close the console. ### Publish certificate templates From c24cb2021a1e760afeb0a1b53faa6c72eb68cfe7 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Tue, 5 Jan 2021 10:44:30 +0100 Subject: [PATCH 052/206] codestyle: all uppercase in MD [!Important] note blob (line 280) Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-cert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index df2d14cdb3..ed0cfab100 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -277,7 +277,7 @@ Sign-in to the certificate authority or management workstations with an _Enterpr * **Management Tools > IIS 6 Management Compatibility > IIS 6 WMI Compatibility** ![Server Manager Web Server Role](images/aadjcert/servermanager-adcs-webserver-role.png) 9. Click **Install**. When the installation completes, continue with the next procedure. **Do not click Close**. - > [!Important] + > [!IMPORTANT] > .NET Framework 3.5 is not included in the typical installation. If the server is connected to the Internet, the installation attempts to get the files using Windows Update. If the server is not connected to the Internet, you need to **Specify an alternate source path** such as \:\\Sources\SxS\ ![.NET Side by Side](images/aadjcert/dotNet35sidebyside.png) From e06dc94e2bfb7b906a134ec1c91497de9cb56762 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Tue, 5 Jan 2021 10:45:11 +0100 Subject: [PATCH 053/206] removal of incorrectly placed indefinite article (line 296) Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-cert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index ed0cfab100..2ef81da96e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -293,7 +293,7 @@ Sign-in the NDES server with access equivalent to _local administrator_. 4. Close the management console. #### Register a Service Principal Name on the NDES Service account -Sign-in the NDES server with a access equivalent to _Domain Admins_. +Sign-in the NDES server with access equivalent to _Domain Admins_. 1. Open an elevated command prompt. 2. Type the following command to register the service principal name From e9bcd27ac267a6376359f598916f8d035116249e Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Tue, 5 Jan 2021 10:48:15 +0100 Subject: [PATCH 054/206] remove unused numbered list item number (line 326) Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-cert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 2ef81da96e..c5273dc500 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -323,7 +323,7 @@ Sign-in a domain controller with a minimum access equivalent to _Domain Admins_. 5. Click **Add**. 6. Click **Users or Computers...** Type the name of the _NDES Server_ you use to issue Windows Hello for Business authentication certificates to Azure AD joined devices. From the **Avaiable services** list, select **HOST**. Click **OK**. ![NDES Service delegation to NDES host](images/aadjcert/ndessvcdelegation-host-ndes-spn.png) -7. Repeat steps 5 and 6 for each NDES server using this service account.8. Click **Add**. +7. Repeat steps 5 and 6 for each NDES server using this service account. Click **Add**. 8. Click **Users or computers...** Type the name of the issuing certificate authority this NDES service account uses to issue Windows Hello for Business authentication certificates to Azure AD joined devices. From the **Available services** list, select **dcom**. Hold the **CTRL** key and select **HOST**. Click **OK**. 9. Repeat steps 8 and 9 for each issuing certificate authority from which one or more NDES servers request certificates. ![NDES Service delegation complete](images/aadjcert/ndessvcdelegation-host-ca-spn.png) From d33137e0bf65103de2c2868e90baf82b0ca95ee0 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Tue, 5 Jan 2021 07:58:24 -0800 Subject: [PATCH 055/206] Update bitlocker-csp.md --- windows/client-management/mdm/bitlocker-csp.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 652a24f8e4..adf3b8c44c 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -19,6 +19,9 @@ The BitLocker configuration service provider (CSP) is used by the enterprise to > Settings are enforced only at the time encryption is started. Encryption is not restarted with settings changes. > You must send all the settings together in a single SyncML to be effective. +> [!NOTE] Devices that pass Hardware Security Testability Specification (HSTI) validation or Modern +> Standby devices will not be able to configure a Startup PIN using this CSP. Users are required to manually configure the PIN. + A Get operation on any of the settings, except for RequireDeviceEncryption and RequireStorageCardEncryption, returns the setting configured by the admin. From 9d17692d214d9b40210111a0f9322dd3e8627b73 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Tue, 5 Jan 2021 08:03:33 -0800 Subject: [PATCH 056/206] Update bitlocker-csp.md --- windows/client-management/mdm/bitlocker-csp.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index adf3b8c44c..aafdb95416 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -19,7 +19,8 @@ The BitLocker configuration service provider (CSP) is used by the enterprise to > Settings are enforced only at the time encryption is started. Encryption is not restarted with settings changes. > You must send all the settings together in a single SyncML to be effective. -> [!NOTE] Devices that pass Hardware Security Testability Specification (HSTI) validation or Modern +> [!NOTE] +> Devices that pass Hardware Security Testability Specification (HSTI) validation or Modern > Standby devices will not be able to configure a Startup PIN using this CSP. Users are required to manually configure the PIN. A Get operation on any of the settings, except for RequireDeviceEncryption and RequireStorageCardEncryption, returns From acb77a7ac36583c726117128e92990dac7235ef4 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Tue, 5 Jan 2021 09:08:29 -0800 Subject: [PATCH 057/206] Added links to the WDAC articles on policy and file rules to address feedback on the PR --- .../wdac-wizard-create-base-policy.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md index d9afb2c2a1..277a5b28a2 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md @@ -40,6 +40,7 @@ Each of the template policies has a unique set of policy allow list rules that w *Italized content denotes the changes in the current policy with respect to the policy prior.* +More information about the Default Windows Mode and Allow Microsoft Mode policies can be accessed through the [Example WDAC base policies article](example-wdac-base-policies.md). ![Selecting a base template for the policy](images/wdac-wizard-template-selection.png) @@ -51,7 +52,7 @@ Upon page launch, policy rules will be automatically enabled/disabled depending ### Policy Rules Description -A description of each policy rule, beginning with the left-most column, is provided below. +A description of each policy rule, beginning with the left-most column, is provided below. The [Policy rules article](select-types-of-rules-to-create.md#windows-defender-application-control-policy-rules) provides a full description of each policy rule. | Rule option | Description | |------------ | ----------- | @@ -66,6 +67,8 @@ A description of each policy rule, beginning with the left-most column, is provi | **Unsigned System Integrity Policy** | Allows the policy to remain unsigned. When this option is removed, the policy must be signed and have UpdatePolicySigners added to the policy to enable future policy modifications. | | **User Mode Code Integrity** | WDAC policies restrict both kernel-mode and user-mode binaries. By default, only kernel-mode binaries are restricted. Enabling this rule option validates user mode executables and scripts. | +![Rule options UI for Windows Allowed mode policy](images/wdac-wizard-rule-options-UI-advanced-collapsed.png) + ### Advanced Policy Rules Description Selecting the **+ Advanced Options** label will show another column of policy rules; advanced policy rules. A description of each policy rule is provided below. @@ -79,16 +82,14 @@ Selecting the **+ Advanced Options** label will show another column of policy ru | **Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically revalidate the reputation for files that were authorized by the ISG.| | **Require EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All Windows 10 and later drivers will meet this requirement. | - ![Rule options UI for Windows Allowed mode](images/wdac-wizard-rule-options-UI.png) - > [!NOTE] > We recommend that you **enable Audit Mode** initially because it allows you to test new WDAC policies before you enforce them. With audit mode, no application is blocked—instead the policy logs an event whenever an application outside the policy is started. For this reason, all templates have Audit Mode enabled by default. ## Creating custom file rules -File rules in an application control policy will specify the level at which applications will be identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** will open the custom file rule conditions panel to create custom file rules for your policy. The Wizard supports four types of file rules: +[File rules](select-types-of-rules-to-create.md#windows-defender-application-control-file-rule-levels) in an application control policy will specify the level at which applications will be identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** will open the custom file rule conditions panel to create custom file rules for your policy. The Wizard supports four types of file rules: ### Publisher Rules From 0f1eeb07c89d40d99f0b5b1c74bbf5dd855ad315 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Tue, 5 Jan 2021 09:14:21 -0800 Subject: [PATCH 058/206] Added screenshot with policy rules advanced options collapsed to /images --- ...izard-rule-options-UI-advanced-collapsed.png | Bin 0 -> 42545 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-rule-options-UI-advanced-collapsed.png diff --git a/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-rule-options-UI-advanced-collapsed.png b/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-rule-options-UI-advanced-collapsed.png new file mode 100644 index 0000000000000000000000000000000000000000..de3197aabb61d476a4470fb72eaca30fc11bf109 GIT binary patch literal 42545 zcmbrl1yEew6X*#cK|+Aw?iSo(aCdiy;O_1T?(Pik9^56k>mY->yF1JG{r~Un)>gfG zTW@dG)Tw)J&Fv#S-Tmu66Q&?1j_?)dD+B}tf~16q5(LC2a|j4XN7zpvJrh4_d_NjU zCna$qh^h&^!;hQKW`eSU5D+yn@Gk~mKJMY{B{ZENAW)qD`9Q9j61qb`6b?v=2&%a2 zon*pjfFy7S_vOwfCOxw}v%(F}JMPy+4?FHj!Vw@v6$QKf7vV#54A1in)kOr+N=f{G zuzPBbC}F1BQ4G_==lO4Cjy!u^S+A8!Qh;Bs2|Bm(}^DnJPU zAV1n1Xm2UN^Q31Vj!77F#Xmg|F2Imi9Ws>-VAe;`l!b?G|ETT$b8?mEBdHB`y?RFQv=%B}%-K1<12zNE9%p(CoR ztfL+F0Csn__sY30iM|76ABam%g`WBLSa$chH&T4;*TM}P#zo{n5zf&*<0v` z1O|RKV^aC*8yN$)A8ldD(K=4mSgRT0a1wouE_ZI~1I?d*4Sa(Al8C&$nmBCAxNP<3xz-jr}avTg^BuAmt3jH&MuXZNK3?uGqO zTb_1D65+6o5v$Xi&QYslIODm&V`w)+NS1HMWu{VG*x9%3J&xgg!{FQMGck4e84SR2*y{*D1#W)&AR@54uaI(vVUT{nyZQC4@lfxEO0K!|4^_S}C zBb(x$u-#o}yG4tzeFqPJ)DCpDRXXAp=o{QBD(;t@<5rL7JjuPVfRGtx!u2nRzaN4# z8h(RO0;hJrwY!zh^aOE1sm{lf)OoSRXKyPg;IT_s|D!h`lKqKHWi_?Eb|D)Z!vrk) zQ<{gO9?8_P?k{D6=snmN0h1mhV>2=M6|uIKE^klRR!!gOB_+B6VBNOJZ`Yy6`38PU zUV4lJaFjPXz4i}{Eqa$^!ikZ026nPh>N01gj!qJlsA#-tQ#9yv!s;m#?!RhgU(#sQ zpIZ)&cQ;q~#<{}WMv~zveGAE&Ms=+otc_@_qywV!*(4*29@%O`gKs?-tMqsap;{B8 zl6F`n=JB0&w;kGp^Dt|^+@E0RPA(UNvgsC$$|O&G*{ZMJOuhRZqwSCfL_3{mt7A7* z(x_x^meXb%jrE%}d{Vf;Yt*y0HChC2=2PB;19=sA+?Q-d?o>bGsCW06q*KzLp|?e~ zKmp%Y02vlAe$#5Bqh6*@^xxskYA3gBQRj+c2weB>F2U(*GI%K=ux3Zt0lJFry`av> zMkTbuar-xN4{o(xIMwq{Rd43%rwAu}(u{0u&&8uEhU1yS>W;;Uv`xy!=422M-S?A7 zL_j6aI8-)$ndxZwmQr>_7T?5`S)1Q0hkAiUOCp@8sD|dlWpXnGzIrc;)IftOrNJ=I zjbEHv1dXVJUHKlDXdYCw7su7!p>Q2Q4mTwFW`kPy>3Q6KEA})7z4p+s!MY4~ZiaR$ zPHE*#wzW2^O3%Pb@yHRw-asKg@?NLrgCj=#=^&Zh)>^(aoA@k@>$5XPwld*2 zxHiKbb49^-gt};DrtMU=oLz5aRMgo=I+*XegR=l)INaimBqy8PRo=2~Tr(MTJ(hNx zg@9vTic|zFnI@F&SH~*`#(7nPWO}w}Kpix-O7^Fr+BHL!dbQZ{X^eizXG+T!g~>c4 z?YVx1rG$Xshh0|zSml9rI-oS^M9{F$eFzM*N%X8p;DD8~a>%iUy$yrUeW(A&n(2r+&Umq!(=fj3FDT3? zANy1Q7Fqx7CEVaDS`jc={BABQTF80X_r*Assi39mciaRI`C&td1%TyGeqcfJ0Fcg1 zf1A0>!jXV%!o{|DxYZN2;6n>eEL3n$#BM$OYw`^-v3-Ij_CfO!ecn__Z(+iP*QEZKY9h` zLX9WWTY-SCk&^~$C}uk7>r@|BW1U}wqGdv#xPctlzz!(UP-uKN-YTV`+OINsT9M&( zq%g1(flIl&CaGjis9TKVp2N?4Vo(X(1^M;><)Srn~DBvrvgXeN>dCjBFht!SYoGN&;rR{+6 z@8a3hQcNxVIz9UyBH;)0^^JF2Ahg_?iN89|r|}L!x*Wm$41Jgmmr1b8(Np%!lxdc& z6vZx{wG9!o%KNM-FD^qb0b}$Z7a?Le4Ss>V|B1Z|>S^Vo)U8x+ivQgRC)BQs_#EFX1Fue}r=u5=v&$;kTAh1H6_a zc>=tOF&MyV3&yAa81}`sLUE9jjt}eVAu;CnfOnAo`c(ITDLkee-2A!#&mUuHn@Uw} zD03NCP~U`X#$9Twb?#x|f&Zvig$RB;JxwJ-q*_R@o@UK8EnN7$DuG5ZDloWaqp<1? z8b!y9@7-MiMOGs8PtmA$ngA4fZqH+vHT^GfB4e-OUsy>C3O|5b5pC@zg>iAydo)N6 zS2m|ngJ6lC-Hy=-(LH-erj@xiH+8rDPqayDwESx80|D-b$?56Z6XFS>56fPx4Y&D^ zGL}cE0q9u;HOW@TRV$vcVTM5o;@|kQdy7m>izviWph|Ac#C1>S@fvVx+s1lse%aBE zKZS{X%>5y&WVGio8DLL%M+$waM06>AGJhoLCQ!n6+8X6Z$u!P&SEF55MJ#l!Bjf-s zm(JP70S<9G00i925sIX~027cfiwofT3$RJ^&uGnOe0~~JAn;7Uk@yF-q zuTU?eCvdZ_*&pG-!Ra278HU)qexZglyLv1nGYdk`rwKS>i_Qg}XZ zP0QGpJOA?A^0W1d8P12P*zo$qBS+sIw<+u`Jq-)|Qz>;zskOPYUGn!cd$5}eRe7j- za^!hlYfKcGW5XF!W9HK!Q1#7PW-p1HWK+j8i7Wpz)8-2yrT3TnVXn~Y1sS<0fW~IM zHq$!j?keD(bs+yc6qFVY-Wkc>GL>xp;MVTu# zB4NJ$3MVjArAhYql1pDf)%m#NFYp7{v4|DvBzakkb$pjYaKXE*STcMw^&pgv(v)VC z){p9&ZR!&-;Qc>_`C*;b_2lKih&_r88IeWHYeTB9FfI$m*+@WzO^&y}=Y;{RMjjI>P{*HPck>8@yM%O{ds{gMb zty8*>Gs1AX#v0XM`KI^>i6V^$JtG<<&sqDfzXB+n%bWC3mElsl4N2hA}j?<9L&BNNq^Bi@Xh-=2L-bd=LVzDTH#E&nwKvpteS z%?+|QcxLC=;bWno`roG+f0&-Q)Aq^zIU>AE6Inb5h$53B^8{dW6X#1YJAdY1Ml=8(Z!QYfs{3d zX_`v>jlpB-3NZJVf61+(L4U>(Ob_S>49ITc*~)ud)ap#@bXp(^x59Zx`oPBHocHS9 z*IvXsIFfgh$X(1P z-oy&{rW;l!z#nSM&+xx;_5VBH`>T}(7QBSpy$ty#X>#q=+`CCD*@sh2?3)h=%7cq1Edc@nG~`6gr@8^`f~zr%E0 zQ@H+=lkGLM=7qr5#Q>S<2c6gjqp#0cYAP7(UbrOV&LHyI)VX4?C?owiZoQ67nd)^Y zWy!V(CwG44e(6#U*~kdice_v~(mj$lDYTqQP$`&*b@7I5;E_}-7Hy;<#l(OA{%tTw z;fFH%$H*^yloo=NZNLK#@39_Gk*LEm``=&tG$;d?%3F6I=t-GG0OBO94*iv<_|NY46al}pp3ABK2POJHmz;uHgVEG=-AX0aX`~;BAf$TNGui!P{yY6 z`;qs{V$JU;2A!Gx{*NGWZ#UrQj`eA>1V~uf zKND@Xzn~2$7 zkse7)ZC2=9cG5;0S65d@N1h{bHM5ROnfL_z8@B%`@Z149(NQpRv^C!Tmx&Y=i&M*dA#po-ZHPz{PGdc zJA0(=MQHF6#aOPZbxyc~J->k-7jOP9t+I&m!EQ8axdZP21*y}J=0k@eI>kRU1Y=;G ziJ3W?VaK1=N`@-re7ZWLAVi;)Sxa(eRUPNF153{EN{9g`BNgZ1xQ;Z)nTwcpKA4F! zm4xPivXW`dq((yAi0_ik$8DTL$K}Fg!yy6vS>mM=9o>?J3Dk89ZN|@KW^Qe1XgEfT z{UP(gx3sP2F=)Xid^!hgm_G_uIwI?k( zS zG@5~l!GFj<5G`E}cT6#2d(D?Q98@OzHvU0Rz}MBE9A%T4>0K~~@KQctf4=@Ei^*#J z$))v=WMd~39|MqV_Hed1OorWR{sf^n+i#|t6_sAUb8P#v+54La03mpe1AsRC)oh12 z;HmdpsD06;<4Edm654JdnW8*e%GdC;k`-$`2e^g@&BKD=L{3wTiYL_tZi#j8-1G8yXk%%KvP!6=A8dOPpMj?^ z2F@n^IVEDo>=c*&kQh~hL$8hSqXLx0R-H>N5#a5}%RjkST?P3OHN{TCQV!=g51Xd@661apSDgI*vCESc=fe|L$Q?AI^N%*L3Q9T0BfG31XyncrKG(}Ium zx>F?kU6&zKk4c}JV?Iiz$UbqxHQsG`kWGge|5QtWfXnG_A9IEzbqR^@blbwE38*t0 zv<)6msug}3cg|(7k6ELxbPDuA=b_`)bA1a-;0}?kr4($d3FxiOk4jl--|bAL7Y%c7 zHBk=!rt{O1(a-4-a|DPv)~HeIKBa&kY2+)8AH_Ov2xL_kRP^crK{?cC1C{Rn@EzG& zRIQlCQVmS{J!`N7xzkG5S8hoL&iAH3*qB#WI~nY$1r-hZ-e?&XF-x#iMy*jH>zgOB zq*}r7^^}M%SCf8Ti}rtd@+6@O9U1v3=b5XRbg+nr=BM&<2g({J8+2!6LgJzL_g`Y zPi&9&mfyX_;y+{wcjXLy4t)lRBbv-RtlZKc0-k};$@B<+ryqiAq)e#X9 z?{Cj`BnAsry2~|2Ff?YgWD+D{)2%L6@liD0u=_KbH&9w6WTx6R>!GgFd868kgb3O@ z30rkouOGpkQC2mA5M7?6(9)N{r&tg8Ks_b`GmzY?X@VNszL}G%AMzafgyF>Y3Nh~^ zr`+M2SGB6uDHrihZ+_V4Tn>yyb=P~v%D6XBC%@M71)S3;`CfU7MN|jH%hOGXAnEWq z=#piTNKoVM(!Erc6=0|3thX}LUk=@f*F(RnC@H2*w&}_pyoaKQX4=}Fr$2jF9j-sF zv?57@SQ43KWZBVUEtc>Gzewxcuxmb(P8E=SrLQtFZ&@JQ%>;w3*EJ!lZyq^vw3s>z{xNHg}SGWi6rTr8s_o7cxX zVWZ>|MCSxjc0$~?7L5kVFkoV3$t2}R(cS<^i-*oR&DcAx#Ng_}*b7ek*kBq=QdOhU z$#$ho%PEjNlJ5RL&?iU|+&uB2(L{$L~MKWFj`f?da z=n3qK(hJRQ&28M_QB91G%WznRyq%ZoYCnllq-d`ACXO!{Khs?QdH+k^y4W_WewAym zXRmYD)tmWkP=azpi?Y#0hNLo{c>&fA-UzVy9BBdIDB`r^W66I&T6enBvnv9iYZwd* zyspW=+sn^rnCIW>IcaGQr0uagX~!pPmUh5Eo)EpJ+aIzuVEF?$l#K({2g4f!#p!N` zR+N48WPHc!J)BoVX{Y6lB7}nyvMg-|<-cb>l@ARF9G#OlU8m0fP%L`|O#|zOiIxVK zxCU*+-R|Vb@0N#U>WrbYiPeRt0X6L=%nbGEGPf?pD`-rcCzRG{nR;4vhiWPI2+~wH zxD2v|6G1ky@xL_Fvqa>mt1B6o^%mZcKqt zvbb+LYQfZJ4$-WGoD0ZD0vKXThtnASMapWZF$rtWv{e0@dL^sYIyyR97CU@wvJv zevcimdLiO3)p-eEukpzXn`E6W&+K<_xz5jK{T#WOjZa1%`5_8=E?#U3scE!;2LagM zOKYc-W-*ixl_(D46FlBKYa`I04_o<-q`p6pay2k%|H+Z=7-0CC2NPogOX%IMr*+D2S6On*-K zv}fgmusqjtwT~jD3I9Z0=U|=J##XHq+%Uo(Qu4rtm5s6rKkL`tLJH7bvyvQ+!_>N5 z3mq_cHnq$`_VV3}@4lZgPMVRe1u|w@G??lrHHY@Cdz0C7EwF*MDv;&vM>a}czq+0kU z{0=Jvo-CC%zqyEyQz~!L`uHm##XEsn1K*D7?EeZifPGrW{xEE)V|lA6^U(q4%wBgk zcXZU~+*2qlXOPt1anT-Q(nZ_ok4gL)R`2|rU?98Qh9C0{2&F(JE-?{XdepkbYikp$ zkdBl_A)2c(ax!O~Q6p=m0gxdq7oD>P^ZR;{F428}rosu`S(eF=rCC8lK1xDap6{zx zyq9?4iFZL6t$dvEdQv)zg5`v?ym(w-WoLqkvre%C0$Aqf6W`NQbigFHtAF8olF;wq zU7ON?$w{8*1^!Imhd$KG{5ave&K|%%gR3B7!Bwrtgy5*W7(>g*%H#8SNt%6dU?3Xi zEWB$nQV>f(iceqv)zE8mBxq*`6xsYNPOBSjY-X~#1+28fC@U)gB1xj}>^ok9!JG^) zQS&F`!y_XT(Yme9%C4@-5Gh&w=Eb?C4L|>uJs9grU8#3i=Qajj|BZvP<8KxykEayZ z^|yL)A4yTVy6cXE0qQP1%-FoEyM2f7HY0170CD5-I#qVPskt1A7bT{X8 zq9gae3|G~+1-Jv5uxJ)xzI#21nZk-Fp2g4Bgwoc@?IT4x@h$C$O($AU)e6VBS%k*w`Vinnnv6Ed0k1s8kx~?A=CAu zX?C$4&`l(*P0}53(jQoQuU~r*jNfKod2B{TMeRDHj5X zSTs8`=Xo>o1e}A#m3j0uvOK1HU(_spU1RY3=6bzW36TeH#sf-jQ??Rq_cpdb`V|Mw zp~8CdhF={E@04toTkoggf&4RRs1v+igrR3o+Fa`fw%#fSWv3J0xZYHAl)( z@y0cI=o9LNma!(P{7iogd_TUCFzSk8_1Lk^RNr!fc2db)CYyzjY`?3e4VfqUY9gDe za`p&(?VUfnf}i=lfJS}cuYyHyV@EG;-g*E(^M421sm*SSRC0C^cMkVmE{9!m4B4G$ z&m+Wiun^Nh@q-=-i7zgn-A<&Pw%Grp~{`rJVe>wLn-?1%p8_>_*ex_Up$5ENfG~tMRhQ)bb)yT(lT3WH41!9_+6Uc9#q${a)h^hpw%07YdkilOH<8k%m9Q}^Bkc8DCAs#qO zM|(7*cR!1sow6_7PQSe_QYMSYL)opm zxSe!r7T$clll#McP}BLk zz0gaaYstkld5sZz5HHz`j}GgIDOlca*GHi+vpsFCsd?7?vO?eTd28KztV3Ipe5U=fh64l9JqZU(*{}R? zGR+@7DS0t7zRy0`YvxJmPG}q~Wkhg{c?N#I&|^YCZ9IcB)Kf@dNx)|B@YU|Ft9>~f z>y=-r6PJk#K)2fa?uQZXAu?>?)jd1&wSV7UxP!0@WoMYl0}v=@Sx8dtur?DgZRKM~ z$tb)EYY~%&5eR#6jael4#roUyc9=GGHE}6rQK)uc#(v#y2-q#iSmsua$D1(~Ja7U& zvy=DYPv6Fu7Dh*g+sDn?z|7c}Pl(79VE)*>($d);upc>T1lBpa*PVIX>*_YxIIGzH z;x#wm@9#pa6jM2~Ea5yP6u4J0%LsCt1tewe;2`!6`<08Y!jbi{=l_J>sp~ zDv@CTdO`mqXWgp#OXurfCJ#=ft<@HxO=o+bA9`dw40d2*YG8uScB(hpBmN|9Bmd^7 z#0tqs`&z3Z%SI?oXUz#bQ-=zB<`_K_L?p_uNCI`&h z_p;t_e8}B1GjdC%$zo1|td3W~y@_9A_>ea#5g#Sk2T91ym+2ql{5Q?%@}6imEn?Y7 zrRg}Je-dGdQ2&36s0zxPG9P|ZYU_mXKZVyE*HR@wLWK0_)x%3qUS36{3VpPY3d^)@ zi>{$-bWQ;vE#l?#Fz1(`F9mt+{(0@z^k)eLrdRNfX*xOot?gQ-AO$6qm|p3_Qeopr zv0Kz!Yq3sGj8)+AWoO5wYw5&KePd%72!hRZ6X8x!mgFIhNJ&ad7J@G}{R3SIW5#f{ zUi!`>OIPZPAjUw2j%HF&eEkR(abR%=7ocS%FiEn;l$iGU?$VEBVJWL(&?lx!YVr_J z^_1sq&3*c}m|UV;hB6V~$Np|LSzH_NZS*VZRuTx&vVFG!f*qmP|>4N2I+5}bp1=Q_4?C z|9yCw7yWo2m-D->q~h;{M_Ns6ut##+kiVMr`)wB@>24urk-^D09cwWe|M2wO>(1U| z`Tc5HsjL6LCG&<+${?0^0!zTK-|LQpS|=8!6cJiP&CdH0oV|n7O$x+*Lum|2or9)Y z{W|(Rf16bTiduearU#{jyxbTAedYsZ>kWY!;~Qm+zO&6KD=Rp7r=`{M=*Hzflqp|V z_}v(oDArYse8A{(cQ+O2bRB|=Px*Hi1F9c$2|8C9S@RKmIEFL-Kli(~oV{VNTB5%@ z$A^2EyE>w{;X}b;_Ay~s*q*AIG3GifU?4H-?PhLmy7yeK8xzq@DJcrkQVi18GH2{9 zLkOH4n6g1afliJQUwb^jwykfu#l~@0ytorHtRT<~_7p59bfIm=YW^&mZd#np00ZEC zul|y#5{hiH*|aN>0mM;jb&lLzk*cO5{NF_At}=m{gF$Xig-pISuiak4n6&r;_XTaS zv=JN$5G9Jstc&|r+s+7Oa*}3fbkgt4X1>;^4Sj!omr*G#P1{|dcpt>Z0j^p~UBq0N zAD^-J61pmPeY?e&MV8sn*9)eopb)$2|I!;N-^G*1xw!Ee&N7VQ#zL*w7Ahj*EBLk? z`QQ47z^PK9edjyE>s=N$M+PuG4*7JsRM?De94=D~{1bT1{ge-j`TE;;wC^EDvG{JA zHL2J|yE(f#zK~9FTSkW(&nAPmoAYFYXq?lBo2L1xG6P`erQj>)`cy~b<9V;XFom_$ zw!D2)L5%-44VosLtJ5Ql3TWOa?BgFdHmO`Ae{iGH|55F0^btNll+?jWNriv$N1_z8 zfJ=dbcoXGAllwG1aaAlE>WYDZarO8Z^o3JW2PNfqind0od^Y>=_^^+c(Jd@~OpnfG zh~x;NIMt3>q1i`dcsNC%WFROAnGMoVh)s@H(ohjO@$W%-B9d~nL`EAybzur|(d)>|D6-TeXK={XZ*pg>q}i#rIw09Qpy{pDVy9itnG@ z???{0fve2jBT2OM*ilNcS=V!TTC#bcRi_#Lx*$bOxb;b2ws7gLntdJwQd3lFeQQmO zc!ITcb>#$772Kq?x98>g3(2TGg!^o9{vw{pL)Hq6>SsJ=gu^ah{H`QE&DG2KQYxG8kAn^xjL2 zD#ANrE}=p$XB)-D?K0WdHX$)@ueUJqO6$k;=0+6PC;F#f52EuilUq+z>s&!vEsADy zMM#uU=o2E`q(-9S-yqgwwNNL{6DHxztXTrNtXdq1lg+$>ak6($szc^o(?3ju6DYjl zyAZhI78zP~B-RNr_cBs-h9GxYGm6Pnu6mejhZ^d>iq)VkX+6}Jp1%(+_-WO2am>;K7 zuKoKr$nQ~FbLOota`dwQh8Gn%L6_U|t;4bzlKP2v@%VU3Ne>!>4Z*)hycqWqSSo6Q z)}}CQkUA+Sj|1iKmou=jUzjxFn#BU3zp=5a9B_G1QMref+idIVJqjB ztUkTk^1G&_=wng4W0kizlxLa8@Dpte_Ht8`nn56X!^v9y!&i?;hMK1*{eh88p+ zz9h}>5h74iFh7DIqAaOd zgb48v46@k7`>jAR(6*b-(4iH`BKOYz6E4c9(QL)>9i~w@lQfKSYi0T6Qy4t|d96G6 zO24EpdCtffYVhpT&e?Z&XrQx&RYZfUy^zodIDd9@=CnC!pu$Jv32dIMmYB8vojW~t zIqUk<`xVJG4De@7K)LObu9{J`GVNj1gD-13r}M$46@$-Wb<#WX)E1#m4>n_D8_F5B`rQ7&!n{XJcfAeRDkyD*{cN&V2 zx(-sg9qI=Q<9uEINGv00Z}L^{IMnudOglde-i&AkLLLZ>0E9@;jx^($l z@V)+IDy0D8f3@A>_6GW*c)$3gC4*7v$QlLQB}It-mLn0+FiR53iLfQ5RCk@c$Cg4t zbP~I003JEQ&doclhuhzxaL3jn^-s=n#%{pDr+B8WaN983i99@LgI^5VZCT@&&;*ny z=Bm|$9eh}UrtoV^lLyUODMe%3MQDeJ5);NXozacC{o%0Lvbu9C7S@Y$4lc-^z=u>@ z%-P-1r-NDoZJ~(9+Vl>se#YM{Vz2nZmpkjel7{}YMLv8N03=JS>>@KGq}{u->WjXo z(DC(L&B^%Y*Z8sspsI`r)&iJeP#aW+sfBU7u;u!`%Cz~i)?oLMojsR3@I z$&c>dl6V(yWH1U1R%!+rT)PI9fUV#X7J-DW69OY_0R% zH`0zl#L1YFjDQz#M}v_|J4$F&!mASVdQK6#rP24*ZCY|^GP9X3^PnAP8!`*mr_#}a zQp6ZZ1(e)xk!Gw_@4>?(B<@aFxsYQeM4mC%f^g9*^hORzPc*P>6kW==4v!i6$vaJ9 zfA*sH%+BbsbG^c|n#}6U2vI$x4Y+;QH~9{WXwDq-BMEGQOh)+!T$vSQmAT4LPtxu; z4`-qYxjG2riaeF=kTo1*V#2aMskG~{%`b+|R0Xwq;YG*DtAtZEi7RPIKyB&I4xAqK z<#$r4>YrjNcj{Cue|Py>M8H?S^SN`vHCr@cTfJ^fY#CU?k6GV7&pu>C1v^S^S3=3B zyVkZy3+-Gygp9R*U8Vy(WQ9Z*+~OM+5rcAGI@*AIVZIJS4% zdU%%N9=^BW#nD*+dsX(UyOfj+~J`)rRNsI*30~JX)2+!cUJw134d2W=QP>XIKrgU z=E>r~H&qV{m%;pfU5WOucLF2W{dQ~;WWDX}{c7}~q zcN^N15-rg$L6|2)3p0Q(n%F^XE15#sr+dsZj`!d>DWt?qng(I_m;|LK9l>006`MZ3 z+xgythPgzjk?YCZ_DAdUqEpr%YEC!gP14iO!qF{@3GFFO3St)xe<@3n?K&X zpy3s_zzaS@8LQe@Iu&6|vhn(2A^P0g#KR-fqzzVV*rP8-J;QrD@HM#W96Y_bxW--l zg5PnSjOqELB4KJeMCGa)1hb4`*k=6N@e!oe3<<109(FnTw_--L<3{+K^G z7ZnD4^!BZ))VY?imTFZ}N{Ssf^2LPkb6+q(_Q1Vhp(Q0rhIBlRGNfBlUQ!*}6;kC* zXPPNz^@(2u*{LVc^VmGQbf_>OZHZwj!hCl(Cp%wgES+P87_wwYI0&M5mj9;?_z&qk$C)zEh7|@Sne*eVn|Z=tMSRiP7VIGk5 zn>#1(zRc8~9C+wom!&Y&S$u6uhQkV3z2(3LA1@vo0v%dLH-ds5!PcT_FG3tqkgh4~ zW@e_z?flPf>yHH^yQH40sATNIL;MJocpUikCo{A7)OA3@?G&%p$p(fUvl^2wtbdQX ze`H+b)NPEpK?(~3)kZMGRt#VFV$8R%5i#MVDk&Pf5?_kMwMl>s+>MzL%Jl3wdHQO7 z@{=Rd9bLY_%Tk(T7W|ilx*0%MjSgToAxxWURhk*@+6yU#xOEiP$-?64RF5=rVOT0U znQeX{<8hgv<%_6?HJAbVzw2(f;ede>E)6t&=^#x_PPABH|I~GMheQf|ANva^Xb7Yo zSBq6wiRX9O8ai|;xc>YlPf=j2CoMe<*Ja3g=V5bHUYRhdvg@Q};V1dMk5ne&6cR0p zRCByOKb}N6d>a-xx?&_? z5s=!=&SH7M(${CR1&-hPpEx&Sd_tZ$y(UY}^pXxtPzjWtJ<1K{*|JC$trs2-6Q==p zZufrvO|+?4j2KTHezoL!#@YU@>LTS+&*L@m4=O4QSU%wA!WFlc-`Pluhuv=dWb!ctEtLNQ%EiQNq*m|P>q*=^bh@i4b`Ir+jxJ5B zhaNj4mDaul>d+5=e`g|kXMe1Pl@v1rjpf`3@5@O{CoVBtfSb!?db#39or9_;M6hc( z0!;wmhgby@ETO$fMXO8s#G2n4l@J_N_fTNFU154EqLh@v{h5Ee_4zj;=08&!ZTc?P zv%mgBq+a;}C(!QUDR=T~aZ`Tqy4O7IE5fUwsb9{z6gc$A;qRP`qT=+~20pzG0s$bB z@ciNzyf@XqNUSMWn125cD=Vn$GzY+^2(#b0F+2UyQXderPpmA*yI$Y^-{R}j?e;EW zT+OAYgw|)0H%iyA1#++!R!`v(%YbK6EC&7Z=r7NeM zNuI-h{8dVmboTHl4K?+TK1Tf5-Ak7kKZD{AoV<<-y!P63>cL+AmOG(kYb}r`2y?ZZ z`};F)1!CuD$QZxeWRQ5IneK$?HlO^38g^Rc7;Jg<&+kHn^nVP;O~w^zm`87FY}qZz zamj`91ih|~J6#BI(Q3{EQs41j=ji*E8MV7kWeu4zgDwwo?}sc@mK%>|e@JSzwm{=v zy(OLz&C>L_ALg!_myzOX;wuSFWFtv#ej+ruRMG66+ktq^n)ju% zrJ|z1r9yP@n?u;boBdWyeI$LT93A?1_;>Z)T}g9*J=*l!S7=@b?Kxd`Rk4Z@Ht!CVv~Y!iDN7G?kj-QIw$rAEEzV7@ zi6=6?%N!?t1=|NcQcL0}YTv{uMNshC%BOD-&N~`9-##6S@2rClAujs=pTyfDlF6Y4 zAkT0fByW1h`V%;e66%TF&Y#nG$JE);Ga@1QgfOt}tQ!jUJN&a!$n)+&4odaWen&8U-LJ(H5tK?oc@ zol%GM?U2dc(+!^DDn*Fk)&-Y|SB9rWTd?RVY=a+ES@x5bQtkEdzx(n|zv4uT(@JV1~ zc}axn6;nqm74UsR4(1m_5h6V0I|VY&v5EBFt=-FVq6?Wn`h?uLXL8?ZiVAPHvD8Du zUt=9tx3Xa-8y4jk!!C{=( zP~PH==9n^@3FiPWe)?Jd=mwS}xr9$V#FY0^+iu!%!DH5|NetT4$#cP~^kuVS#%^NQ zYm5_=%o~!NEh0H}?>j{~kxPAphtmhT^avf~oQRjuL$Q!q^1(SFvHYF6K(e#!_7jOz zlp6S@gKWp*7kHFp)A+u@8HQ}77(SoboIaV!M~th)BDTCrI%40$9boP;Z9scsftlX4~ zbhwTC%U;Iq`8ofrDou$-GS(qVh=CAf#lHvCQe1fgy^br&hrUQ4GCkwj>G$nH5S zf9QPsc6NX>r2jN2c?}nHi&btg0{bb>J>tM1!nGspaWD0bmGWp!#)?8Q&|v}E*#tI* zV7+y$mwVDYTJI-Mor6!S4b|W=lAhe2?UK!ZfRDyiJ+f_Z*m2qQK_z6cFIMD7 z$lbRTJ8R{@R3@5I*lC&b)1nUyXnl@+Tku@W#~6+W6s z@b0sgmJrP3;@Oo_)1!Gc{-Y0$`f4u8x%}bX9It3)U+;-&a+AOXFH$C=T2okBbn2aT zAWp2lD?^=b!=#&(1tDo|s9hBv@k%krqJseKb0Tz}AWq*8I7gDDm(*|;F!wmv3us(C zxq|YWMV^H9mk(`C{s+jmXYRsiuWtU=?&xmbIMe>A1njQVdgvY7TOl?yVDmUiOCc{E>Xq5l+lR&bRI6UQc@ITM~Bm1!wxVmT1W}= zYRZT|F=pG~n3-7>wA=z0^QPn7cx;kX6L-fOzb~8M;xEMF?>e#mD%+kOU&d;YN=Z>y zP)y{1uHU%5g-Xdg6j(B%zmqgh#{R*rKC76U{n1ndP!<#vR1{?5B0RUxyUg3o`ZnG#$`l^{_3CO*=Ed(+*?J}nXYTvBoH*XI|TRO4#C|mcyM?31b2rS z+}+(F=)?)`?(S|qQ>m(5z1RACuO6ch{v2m8$jk@d`&`d;-|r$%W9c*z#Y603p6SdD zzq!e-MCuD({X1ERNo#WtGVJ4N9Z4@J1qR(l0OD#m1-v&kDKp7kt{fV>vQ(oSO)U?@ zQ>x#t(~MTLBZWcyDgL-DFmJ5R@j9eBknwzf9q|6TwyuuVFpn;2sD`WOueb6oM+eo5 z1<*VL`FaL@)?y`s`5Vr~mU?My9ylkRd8w@qh+3{WPuZ50Bu|UUWgf7NQmaOu!(1I? zJ7cR=?02k<`X5i4vKpQ|!3Q)8)ksCLay9N!52{=cR{`Ry_ABgeJJ-(%B%5S#VPv-R#~@C_lk zfv-*mO`@Q+@f7_u@~EV6W@ z2<7PbHV@m)UJ96vJf{1A`TYT{waq^h2t%O5bfNJcA@n}ZUL7F%s`(+@)Wld7fyCQP zq&Mo-nhARo%U=WKSXxqoO9`-*1gtjn5)~{#*+^NZ|`~^(YVW+M`=c7 zOfWSR#)sbgktsF@jKP^GoX3qG=YAhXhQ6lwW9@4^-2Phr9uVkg$&0!v-JlJuvA+ym zT?QnxN)7axJ?G=UYf^7LdV+UOJoR5t53Oo=kvHkE)Jn}rPnTel%iuEFz2B?ORx2-u z!i(4$)I4&>cXS<$$3|Si*xv4IZcOFa%Vd@rN~ayyHu(Bn7EU3?E-o<^muwPXSLNt1 z<+ZdVvm(I38eBvXI#we1|9IXkD8NW0zcrsLe{YcBEt8Q*&L+A?)+bx@lG=I!S+rJ> zC>*ZK{^`#V)cn|E!SPOGwTIni4~kL}9G`S+iJk%f^avouqWM{_d-3$08R6CPpDSu9 zr)G1K#jL<)NOyd0aUBnZk3Pb<87_^V<;_{Ep7XZYc^6RDJ?E>AwNmY?#*v<@KX|*V z>Kr^@Z-&chSEcT+Wu%fR*VwOboe%2EW1-ypjT4v}nx)r%To22DGUNDTC3 z5bH7TZX?%ihQcXHR5ljgo%4?rL|>B(NlHoR$4ykq~%z4j6}`a=<>3W=||MqK)hv9p25lkKF8WEOcq`Fta2s<*{nkIGS;WeE0 z*$hqEp*wHi1GQ!9SZZNHFPIQf8pR`@8l8Pu6}9&J-gRLAF=O9ntpDH4&}V#Wg>uSl z7C!oMz!?jTq6x&?WRBl2Efq9$h7RiOZ2#y@lZieg@BSD$0(-&$yb>sI#di!|^Ld0S z$EEJI8rRATT;m;|e$C*L?_cW-5)f5Numh%5?Y{V6C;6ge2kg0%Hs9ACgcR;~uX6U^Jxd^5rvL~dm9nhujPM9^^2 zrZ^GgA(Q%R#9ovLu!0b5fSu<+uz#XFibUyo@V<&6=hWwWc>*DdY9 z?((O!*QI$(xR$Q)EOvD@UmBL$@19{57jr^0ny>d+yZb+xeDBJx1qQJ=N+;4K;ulI+ z06o|RjA>L6%ojEcAtP7Hh+3H6Zu$#=2jbvTJEpb9mxWf^eyna+{_*Z(dz*9k78*%g z)3fS*`;mWiIVec^qu}`9RVY^DL#<=pb!I-@*zOvy#w*Jai;j?+2)*X}&Go|c&#Ou( zg8g%XHl|_DyVaG)jeS;uBb)^BK7*D&Y>ndR)0!c3HwzZ?Ua;s3%3DLVDqQyGR)+i6 zqB=u+Fv_#YineY1<5}S$*G&=jX>)d4k{!HCb0UAifYovbS*IwMQ{HSy&xJ*wx84X2g8Rh`AAb>- zVA7D{HnHT;dI?0-&3)d2<}aNFI~?QummiC@pX-H({ek9-LNi{RY~xan)L zyMo$3qdCH^s9*<-njKlb_eE274C}rvo6ig5kqx-9T0OI7$06mRe!$_aOsn5UKBi2c zt*0@o3%RB~`sui8)KQOZ#J4JK^P=y*9_@1MvflZ#IpV@%9eMj>PSNeOln=t@Ob5tb zP)I5L%Us~oEED#V6&@D`n)~Ej*5{;Db0%=B-puj`4jr;=;i{@Lh{V}6N_oQCu{Q~2 zHGap#G|bvl1W`!BF&$U1AM6nRaj`B=>T1W#Hi*STN158ZzahaP&+AmZdWV!1ED>Ye zK@G)ZjPy-mAbvb* z+pd9k8SJJ7pY2!O{pa72_bZHVN(%?`)e6b>rA;HYpDQw74|K_~)vEFS$R%gFa~N&O zX)ax4$-A$(vK%2=egiXWi;UbA$r~8ce_If-Yvm^VK1mjQwSzBQBjU5Ed0|mj-M;>w z)eubnRTdE~$!|m=nLYhvqSX$BE})}H-5!+iZNK#cy@{!nIsCqJ@yY!NOmY{~t+^@e zz=>YH>C(P*VW2x+Da&AdlQ;TYW5>}%nk{I%YCg5G7|?)GcoH16_VSv}_>r>o`nNu%5+0P_EsvZswz&-|C$6XpW~gI% z3G1X1p-o=u-W^RO86=&sHqp}&Ja{-N>|#t+_AYtUPda}TET5_pBkm*l{hPr=0xjdl z#YJ z5>aK>tA6Pg#tl1`hg9A_$DbLGHkI}(GbP=rl0Ca`+hkBNW#2kEV6SUE!h#l%J3n}3 zZwPi7M7H#OF5fq`F>2E8FnaNx%1dFVjQcF-BSQ7XPQoTVkECi%AYz9*d!jU`X}H^H z1y6F|GxWhov?5E|SSVULQ3Npp<{Z4mkfnWS<6?2nxw4Fc+NXLzgdC2^fOiylSP)U` z<4?j~tHjllYp>i2O!|sMr+H&*U~&JMhQV3$YsLQECelpKAsZ87GFc)T{&eB%!=%4h)Ts^&b}`5?ST$x5 z+p^>XF`Sc`RUhGB@P)hh7knYN8gQCUO#IoV-!de%ypy9{w{>f#RR@IXJrX!Jqo9!G z4%RS><6LC_ETf4GA$?$p*nQ!D^eEj-~!y$SP49M!q3E!|I&iZtgR z1+SVb8@kIU!cAs3MF?|15Yziu~ySNB1U zBilelaQ<-kiJq+%;ex_kWn{6*?!I?VQQW8vO=gy)nLjfpf8Oug*MB$^f^IIzV4ftP zA_Q-aVm9KlxpSadBc-TS%irYE|+4E zJH398dho)SUfMfRSVTkwUF2N`hcm5FzOS!uwy(Y;!Ag4=F4UoZN5a#MnQ!=e`1l!o zJrX$%YAFeISnlHwjuH#IMIL?a#tqsNQ@!&Ie=W|jT7~f57Z=)-tZIAKMxq3bS$TQ{obn!im_nMdq z+-O(w`0n(?4n-QT9_3cS<$CAr`-MlMhwPoFr7cp3a-Dtc{7$D)8G%t1=GH)@+UIUa z549!M8`z1^n;;uESEO0;y*qbxw>(t9C_%Gm8ohG`^5zPZnC~9ZI?|##>HcryfX(mj z#eJ`|IqZ5|7_CFc;Rk?Gr;OJ&VOWGUE^mms)XnpC4t-rGCz66*7fJ8-E%s#^z{VXf zGf34v0H2zVdhWF_Ep3+s1xWC|faJmG1%So=jMfjSq;VA%iOYFpMCDZTgOzRh|B_?}Dc}efX z)yV9720lGW@E;9%C$PINpX}OpmN`)GIONiMsnxlV=%zlew=PXDcY?%M4K>!1sN($Q zh?>v@1JAD6E5_HLmi$WM*tOvdUqHG&Z!RXo_;-_iUzx+yBMJzE+@(F5KU#nL{$r_7ycjK>1qsJ$l z-9L483F?SaV~QbrS#uTC)<%atQfiUC6A_t5r_L&NyIt!GlS63__}kwHP0`Rg{|dfh ze$>X-W^Vv}*ptHT-V4%&IFsk)#<+Srt71d}F?PnMPpt9V7qS|7-`a8hycn3(uz#Prqph#PkU`!%GI*>CCI&v}@ z{_gdvjZF`~Kj%)~mt@@%X|lb8-qFIqYLOTlG5H|F4QpTHI)9IQM7yeRj8;L4_00Bm z6K$jT0uDB~!i}W-hm=R=^7gG!t?{v0P2z-&lp#+-ISa5!Ac>kQMI&B~S+auN@G5AASfdKc{0%8&e- zt+5>J%aP5GAH5%3;?7CMJx83p@5QbmIhRJ@?P5~4pRhWXn1wA)eY1R)>AITa2>kQ% z6``)A{$hCtj?<#`Lhw%TS6t4~tvA_UUV_>9PHn3)r_A*qr3P%=YstFqs|^;LIJWh3 zh#!nZo~}w;rydW1*cr|GoRgjWoHP;8gqjklLemQ36T!3zd#1pd$&mGY#vk|IZ;(ev zzV*`N*J06Flvc3U*kLC80bXu?lSMmZ7F^^i(3C2n!E6htduyi-gM zO2^99@8NNTE(b(K*_1Z*_fzI0c9O-#ypR24Fc+C67)WCBii)&Io*Xce`?F;rA*P)b zB>%jP;Vn+473L1v9RS5F#%Gay(9LBr{3PscW`6&JK!Hrct=Bho zxOT}mo5$N)z>W%EdWeCvLufdZ{)F8&b}wh*wdodQj*jMy})23urPbH z>|4-AdS`=gU0Cp=Y;S;WAXxO9$$)!jG)vmn)C^@^Ry(O4e&_DzfA8HHBRO;ga@nqr zweXgsPB`54iiUJpEyT(aaGg}G9&EEST6Ip4uyMx{Dj-k6BOio~YU(Sqig(IZzsWT? zB%nQ3Bq(EW_xT3_J?ORGagMX{S&kl8vgw*yKXrCK?b8)Q^YZi$KW~ambTeQdn3Ygc z>v*dSiog`@WPQeGdPgP?mDun*RiS_=~9q~&uxd&qzmTHk*Q3sfe(k)5oKYSTMz zhxQU21Bn$r&1oe&^XXZA1)Q2kXVEotoju9|%~AW9cx+|zG@~d&wTC6(9o8+1IvmN5+az5~_D#Def<>lb=7Z2m#st7FZ`W5W#h4Yh=!-S&s_|DCnE&Q&fOh6>bD-Q)qI`H9 zx09ufvEfhKM(Wd$hQP>y>fUN0mL(u8k*;lsmy_0P|iI55w^e`x+948*^Di`p!_rPgWC9!i3o+pKKq6H7w8 z(ZL;0RQ)hB-^jqWt#ZawtQ3X;Tw5010)bo9y`1yyZ_wpmd=1Cmt6r}68EL#u$_35~ z-9I_hgzqjnb#N5{=i}6zeAeMs9_fDcU(pX)9rvUe*+N%WN70TvCeaF2FE=}}Mmm-hZVG17TLfJyWn6lBsi|bu%@ATHU$l%5u;MFQ1&;7`!*t;@7$4} zzry()j%!yOx&bJ-CPw3|M&Qt`1q~E)S$T0rAEuEVjowHabB85lelh^M@vbL4FY+In0Tv(lw5eE2Sh?17LIva^R2Jen}pFMK`8 zRn;$+Oc9Kfh_YNS0;Bnbo5!EETunGjeyYr>Dm%d^0TP`j_(IQd{r7^mftovXt%76F zH%c!YDb%!KgjodcFk(&v^9Kn*)i*J>szSJTq1W_587}IrmiG*M4El0~YEfaQr(fp>lY1bGo*PnOixWZc1GBt_zjy8$<=4YiU2J7YFjR zvQGO;^{Y^RW5_#u2!uyM_x5O;@%YbwvM0J`xtq(n>v5xQ zi9nrYj;i)T0L+^8vzLM-cJftQz#ZC#wSADF9U~`waCo*<7O9yRPsupg8N7fntq5uX z8$a^&Eyq|A0y{52{5^KaYYbCbGa}hd{7y&T$0Cz(NG^Wa!+95oDyfqSn~H;8VFSF4 z(7(~hiM*SYVAoHZxO4CnWMfS6%)x~-5&*SDW!jm=p&gDC-AMoaHD6!MVxBsnUr2po zQ^f9;Pg#c1d!^FPzKfCf#xl=^R-owlb&o2d(-`7ct|MIHS^>F_1X*7@5aDkx#vcWz z{`;ftG3|Q&tAK2ujrGw-7AEo`_$)cZXW)MXV)V3BqndPxsmEoVDUxup_eS=$E7Ce+ zT!L66xJxA2+(qN6^r1vK0+JrF(>~(d1^wnuLSg90d@0SvO_RBmX&YTsq~T4})Q9|f zosvbMf<$BNmP{WOxZBShSNgy1syF+*g9&VRzBa5t+K`*bEhaSjpg`2GVdf75M! zv4v5Kn9x|6fRrE5CTi|KQ0H(0;i3{9;EeHFojjB0smO&x949RoJenhu?ZIMpzUr&8BPWB~d25)j~ubAP3KJXaT4?AA%6^9=$Vj%ko&*HZjA0`4V> zUU)~9n!TLl#+81C?*yk>Xw)6b94*#&7l5YtKvF?YtOmmm12C<~g8NhAVc}krWdp0y zq&F?ZJj|l_*yc{*!%}|iY=kWY{4Q1n!a$3qvgUfh0Z2M*p;E{vj4ba`^cJb+(~ZL| zLqkv~0|}ayq~q8_@pbL|!E7_Nd*eoOZ1H)c_rz_&W3!807E9kPhE#+niuK_7(dxm_ zfHvk6Q^rgsp9g9MXLgu{FVg+C8?F-zzk|yFwDqFqbW})dUga}E)vW}(w%u)q4-*sh z3F|rjv}NkaJF#dYk3?F!EE?l~16tsVVw{ocCddfz1-&E+kJd$DL>llDFQji*xu;xj z7X6CtPbwmDohqB8^u-tJiGhBU4!FJGG4x7~tysIP^9*E{@aA0Kzw@!>K;fk2#XwYb z=gfb^)wfKZ&jO4)>(3pGtzld}D&sZy@mijg;&rNgcMS{HgWIWebCC8(Ms1@`o~ea* zu}S>a26PiW`a*udTEp0KC?zbWVGELO@FmvCYsqUctmbm6N;%DCjg|bx;5Y~S&q=&< z(wcx09+KFh{XXA@`@exO)fSCQ6C$FBkB`p<%|hP+s8=AIK0tW}6r149egx+-Pv*sf zZWKlW#EG?-SNOY;+0t`^d2)leN@!Fus{?16?d}v612qJsT_#B;KccqcfJSu@I2f>L6}Qe zs2X1FS?TJ-Jmg&Yr)44_CMgFL@_;@7ly|_)NS${f57HditB?W2I6|; z+6Ci_s}P2!?5POev#Cbu7Jl;HBG`rJf;Jt2>m#El0m$cVHM|^CCckc==Cgo#YJ&bt zUq1hl8WANO?!8WC?q)iK{2x)u+r`;C8P|QPSt0jxlnA#(0%fX>$gaTPo5+_TWe3!9 zhLaMXgF|k9i`Iz$A%_D0T>GN~B*mYBBOzhPWQ^82%A>V|eQQiHpOH-Ia@Fvna zxwTE0Y;Ie@<&nF)Q*i<1MV^(ERmt&hb{INLi_>}vayt_8gGF7^W!z8*J6{n*tKT?5 z{--VbXKAn|lIHG%YTn(+e@hQ!so3hA^PtuR2AVKH`smPlUV$x)%K7|zLB+d!x7>-N zrKRvG*!vK3zIOMcmC0M(inKq83#h?pxSxvSIMb%uyc-gTE|n&yWj|HTOCXuc$ja;2 zuVZX1YOk*-D(Wsu&cI9(QMePLGDs?fFg@oO`wg`t7mb{Gpv#<8VWhwzaKv{0!2Cmn zE5}E25>{3ck_htLd=sPHboGi|=UXdLb48pY03e36^c$@om5%mb)dCJ(NvVmL4tBny zqOl3CsZCEywjEMY265H)a3^W=HO9xy+8zi%6Y^9Zr-4PI>m8C=xI0c#AyZG|yJKbm zeR@ruHvR)S4H=nAG)|5C^+DO93*IffVJ&mOSd_Aot_VMI1}2}tV774d*0vix4R^|2 zGNP`r?t-QB+DeOWm;R~{u3Gs*95p4aq+7dl-SI&L!2s*H?4MDP`%+-i@L0IocTT6{ z6=o2def#a}oi736M6C6xvI9qe-9T58Qr9JlVW3O|Lr;2QF{Uos1IM8U?}qlGe)X4G znbb>h4HMoz5%SO){pzzv&6X{I$5~Ctgo3cjNW42j3n%#Xa z(KLtTY}4lLz3Hb?N9(rYzmp|G9C3>F4i44!uphlytxhId9%-X^2KdYhoVj9q;+v9{ z)~6IpGTn|&zj=iCb`_Wxm)P3nw&wGye^yVmX|jdo9UV%k9d>@y!^z#L9`eh+G73Q(=-J88VOY{<)B-Z{><-$aDkjo$D$A;%yWHMKC~;^eaA zbzfe#tID~A1SeU9@WybQo-u+TBkO(J85Ea!)$w}72D&@z+kty3=%!*lGeu2^19ylW>C#$^7Tj*UmA#>507v^>v7gvqu zW`@-b)!wZG>z2vO{shf=&xd8}wcWLUOLXur-CV%#8VW~wM-jy(*L(TZ4NMx0uMgH5 zI5UnpWMsw~oh>N_I?mS;1o@)Ep4AG&x{?4b&y3IQKG#j|uOp94qc4CabigitvKI^O zqpkQ&OXyzjez9WFpP$8?z5OmFs~^WZdTC2VZpI6}NvHkXxb!Phr)?pz8kQJEPkASdnuWsN?COVW8xk7mh?2rZXb9-2s3iy z9*du%ik6^=l`cLj^Ju7F!&=ossEXv>u_m5pbOW+uADrnUPsCjC+A61vDw6ARW(Fg; zO4z(O#^rPvT!O zy=~9;=&9y5>+zHgJ418kAIpP5BPW+yrhC$0Qr8ce^$QPU&p3vqc)jOQprT9BB&io8 z@DwFcxeds0RTq|my<2!Bp*v~UZrrg(FKQHDyxjlL0PJoZY;YgUwy@!d6R_-sM)cE3 zCh%CX>O6)kZr|_&D|lm&wo$R+iq>RW8z5}*`tfe2KP-lZxh|< z^pYGAfS<34=Cy`>x-)rnb=MFvd_u?h($&WwGP3V>obZ+L$XfL$R(Fj=4bSRh@2(AE z;m^zbj)j26@5YA>Z4zj({~e3n+NqZae4S)DHqhd}771Rgo6dm}j3B4WReh21k8ai^ zMSXrVcJrQ>r-?kR*C#MJR3bnJPu zBc7Qzikz0ue0yw`Fp&I)NR=xl&s!C$l<3bVe6y#XF6_K7Tu*bM_&S9m6$^ftm8`nC zM-CjcY;P}LMlGR$$~DUVt#BD0~C)@~D~mLOBeL ztdz^em?fE%OO=1*eNmkiqi+`T-sN5*&SrF9*S2@}dX4nC5j=YdEy``CnqgNICt|33 z)XAz*NuDkF=28N^t4oE25@?Ajo z&}ue1klJYaDnJ)vk(Q(l<-A1AQiXZAJO&PG!hIM6-B|}kk}Z1Vv~l}IhI&xlPpfbb zWoB8D0mIg-N0=3OT&8al@V_->g#AKj&QR<&zcypB1F{-4>_{?XMoC?mNucFMU3q<<6*YKGAJxi=8%@tW9v?92#r3&(WF7&XqJckG8Uj zgH9pN5>3>B`5tQKklXBAkv1>((gX7>16$AB(8BPKqu)TQcVs0&9Ji*xi*^%Tpc>C#3~UQu#cWUJbCLsZ z-+Z^$=8fwL;KE(ci#$8c%kf775_?}>4})$LC*b8k_O4vmb8|Sy>(q9sEm*hAH<7=; z$G4V%8+#wc@Mam?=XCat5!>SO;)3Sa8HbdO%#<^Ty9ISkCve41W=B}?RImtMlNMjt=U zXNHxlHEmhvoL*^_q4MU025gGd+_IYqbowI`k@7vMxqc_^lj@O)&h@4O3bpBKncGdf z{Yn+f!nxmcKNh-u?(sK~{7L7D=v!|dku3TK&6h>*ul20LXwa=Y>un~|?s%RH z_KWvzhA#AJ`^aU^%|MRVhIG{Hno$vI4v*7J;qRp4Rb8r zC@SBotqk6QQ>2g=>Alsyf9XV7%97WTj)b!>&G`e3wcfEpgL$HYZoIONGFZl!C79^e zH?j1tUFQs;-2&ZNU{vigfqe=_xT7V6L=#|AipacxDi{u@AJZ&V0f~WeqcM^SGl>G} zN^$=P5vHgvoZL42;>|>lJ$wK=x^Jkdb1;)6c5)>>dfHB&EUIYVJU0Pn)fLkHO(nP7 zSn*z;fTFKEoFR-=pxhK0ye)3j9SYCnL9$GXpl7qI-9khqWUbjesf^q~6*{a%>AvT2 z`B`LSW9MW{)u<*3b~hUR2t%b`PJZs$OG!HCmj% zLsEppuXbd>On+2G42% z?S+i`=YjDjIJf-Gy=8lMAWHngD?^|JSHqX9F7!mNI>eu!=0^8Rz^@)>0nF;96**-l z)gMFe&fe#HQM;xpCBJIqY(T`=Ca349kujn8M3a1ZFIWq;5d&w=>Z|<!+fS{M8*NcO(*I4plw1O820I0O z_E+?F0@}i#XvcbPG_Q%;{Trq4!PQpTZzDC_7?yWUzgD8P+kg17#^`STLB+}^q5;p- z(wWvhmjpdz=vQO#nP>Dec&z6`w5b4IEx>iRh78Krc;eD1%XA+zAa5o1sHrG63|zJc z&N>~A;1Id2kuzSr?35~&xS3sDSi%?>S|lvGd>ZQP zcVl&D=69Ie5gNB&np_+U0$f%$ViDlx=%~jSj*-Q1n4UxnhwCoVYkTm%T~ytMc`DM< zPYj${UKI5Y8YpFN=%B7DjP&j6d{oi8p;gxq1TxM44u`4Hfx=-FGYA>v#)#%N;t{oe zg=NIDZ9FbC$Bio#m$Nsv-mAtwlceEYGDRXwQ@~gWr&}?b%fwOgw}`Pp#hL}rPkGoV$PNe+L-;i(?=yb z`J-P;PTZ;!_93$us;oQI$;MJj#yf9WT89+pW+(Xo3;)pXmYHfOti3&YG)Nv0JHsmJ_LH6B%3RQJ!Bk=CE#% zw`zKQpyo4~6jXKq4oxbcrJ1`CpH=Iy*!WsuS{c-BS7jeAcNge!2HgHfR|$l@f{LA& zo$j;Jt5Jpt7(-Oynivo&=8i_s=TYQPxIOJ<3;lSujo_Q7AfB!eKi!!P=w8JqFbIE< z$pU6Ne6#?DPedpA$#qJ364U0q5=@g?|4%}br_q%ZADbK(C&b^8l$I9rFwbC{e|A4_nD_^1s#M4z z4amq4J0K4emqQMUZ?(&L7WA{4O~0&R zo?v1s>L;5VQ)e~@2=gn;9AAOJz~v4-u}X$ko}~v53k8U1rOU=P%IPrc{umt|9u_xX z1y!0%a&{YA+AU`nWjT?344e|BHn~83g8%^3b=~#;_%^7_oz#2I1iddk-*XlIe&!DA zAG~XHhzXF6k{IGp69P;c8uNC#>KTzrm(>9Xg~fKMl~;0lFw}oMJ-$&XnJKMmxjP#P z^Uz^7rsm@GfZ%P%#>l|-ejLsV+qJY(3u+&bl#oEr?JEU!%OBq01HHhpk4X=(it^iw zYfIl_@~3=UjxUWn%^INr{pHpXhCvXLQl~=7P3Lw2HL52(vh`R`Qv;t@f}&Cf){Sya zj0rF2ZcpO=G^aqK5$b5}RI7_iLCHM&_V|igpFnsl4%_wl;#2H|GOyV*PdNU2LqalA z(t>e-$726zXlDo)PD!wrb6ff>$x0m^Ih^xy4`)=a(~NfnDXH{<4M5U0%^G z%ZSU)ge2b|H_d{9szl^CrhEP4#+!V*e4j99$;T#F+O0}LmU@)Nc`C@<;bv{dQ)yn~ zUsa_>@*8WfoTk~h;*Ki6=4Lii3 zlPL?TsCNELx$33av%A}(Uc4;jno}n0f0>Znj4#{DJ+@Rw1OOz*B;Xyj&0Y6Bx3LBJ zp)xDRen&6C`HS6os#(c;*S}mTtn<{DBr;HjD=Jm3qfQV~n{vlc2iJVYu+y5kfv9q! zpMV+i&MTIlLeNEn-TiNDN`gA>tJ^SCs>BUMcc#rB8&{L9y)aAjkBepu+;v7pS{+|NXJ zwkYuv6`G*#VowWD;g5f4R8Fql2Qfm9fziY6ZDkeGI?s#sL)!7*rQHN^lvT+V4EH(W94%_HP9LT&(u0xej0oglGw23sJn63Qc zQ^~J-QVG1-;R+8zq@1+r;&s$6H|wCfdqIcI>!8L;BzEo=yiwZSZ{2rhnmIWQvMIHU z{)F~hUv=TH?z&+a8k0cOS^!VtU$~6ZV`b)0JdJO4dHz(OokdLS8%QUzpCMHH|vp^rWc^Vg8DhfPl|LMEG*m5!7NKh6qZV4r&j7!e>%5DK=~WaA9ZXW?-4wp*Faqq)$7t*Y~4$Tot?jRJ**^E!*E?nf`jdYjw?R`)7 z_DvQ3zuGpxVx%&kIL<{T*QKm~u9IH8J|zX7=RRB)#;H19-V)ESppO0;0*@86V{Bt} zk4a9;f>>K)rQ#A=t{A$B;RBKu>(#uzu;+xria@Vu^uvFGmSI2dyVC>L>jVvSs*#UF zfTB3t1=qbqu_>F>*?Mk;5CmS)s`DeRs0!dT)xC+_1-EcEKWg@s*dBHo1=e8yA@&Fb z6Xkpujnqdb#@Vzb9do6gp=U`@&t}E6_uwnN;SQVS$4GMENkaUhRKzJHVFyuw(Ty-% z2pv*ovjp+KEvE#_WP7uo+hyiXAA<#&TzU+6Ac+?cAN$|c;Z*&cl2;P4=$@yjdQ|BR zP&)nWTWm-ono()r(0Qs$h+(wyN9&`%B)Y0wf!)xOF$URKOdUQ=Kr=4rWtu*1cP68I_FxSq z?RFbh=XvdF^uB`Cxac5zlM1y{oL9cs9hj8`*@Xn0Rd~QDW0%A4YlHI{kYO<;?lXpwaSCw zk!JVhpiu!TrG=CcBg?11wB+Mu4$y@m`F&ZjAcE%dfL^#J=dKG{q+OKglGjXTCifcz z)L*HJo1DtRHF)OyCgIHuqHJf2lEcz?mdtMp=BxIPi&^F(AI3+gBdyhM+)z z!LbDFbuyjm@xk`Fb7){mre&ni=mm6hRJmdU);O#b@`2P*br5dK*qk`C54&)08+m(9 za>QiY8Z?TbN=>alU$xmkYyiA)#J6CXH=q*4fyiQ3m%n!5qSqi--)Zx=tAFMeV3*k1 z>KmH*I59IaF!$RyGMd~4SC*R~kYpL?BGll0s5|AdYXdupejS_t}+UATq{EXGwk z6SjqfS>iSoQ{1)5uFzX(`_$*TyPZOiPP&?CwIq*;>4C{5WpcnnC^S6I%xV_SVZ;bp zxEBw?2A!J3{4~~^|FL;!w4ETU#pSUfps^&7_GeY%-oozueA74{%s0@cy6Bu&Z=*7y zF{-(QJqQ@TTC?=umf$p?tIW$3LH7<;fVP=`cLhEHBpv=Zexn25svv?gv~^?hMK3RI z|6_Y#@evW|_w1dyAD`v2fa{{QPQVC#M-LXv~NueE1U zw7g(0eAnA1N^@iXZGqS;AZEPx?A6c$^uf!5p4uckBV?3|U8DdO`iBmR*GN`%GX6K1 zq@GwxG~r|kk#*#v!*AgA`>Lzrl~ImN4!Q%(`X~|=gHuln(Jw;F)n1^nT=|F zMbDUIrcxk$H7O~{#=+$YpP0l(gJ-?IAS)(jKe@XHf!nM4`v7T({G?e4HY(WHWOVTI_o(?;z`|M6m)OMeXne+Kr7k&yKPiV z)haskGI9L{qTF_7?n6?phZi!=DcmB&O?-8$WkMc99G>nAb9fr}snWInrr3HvJWgyh zvpuXoq(zH^QTCotVN~>W@fpv;iCo<~&DaY!Nb!Hwc9l_WJ=;DtC~ifI6iIM*XrV}p z2X|{BC1|mth0qpSyurP=I|M6QEEFjgoB~CIyXy=6-*w-;pWdhU<*YSl<(xCKv-ixN z*?a$fi}_Cg}b7DR*XwyZ-D*VphM-@&1PY?`zzBc)f>c|nSO zj4r|-qC%s7mU-GOooe00>b3@RzIBLYyes&D-RK=RAG!3jiWbhs)kHryq|OOeS9n%y z;~!LOz!2d5n2ej3WiL+OwYJaU3oH@5;7bvLhX!6InAGW5E4j-QP)YuB2sY}8pc;N# zD4Du59wDDkhSU67ghOOY{LHOUg~?^&g?;J_6$VMa=t-CClP2ej;hVm5?FF}c01f>Q ztul{>{-j4Nu9)bAlCZ0WJ^Z}F;?8Fm3T1}A4vP-nC;bwI;$8m%nIGI%TMP!#4QG7w zyD*OwlXBAy(z-EY$T(;DeJ7(vIhCp_TJgmRRTye=%6mP?b)p#NX-C}p)mfhfWJ8gewG~4|+>{JD!%J>n;c5EFF&o7d z8D`f@QDCd<+F`UAFB`^dgc80%hz==ad;bBhNWU5$lIDhyI|v|FHMFAXO{NSKWVQ|=!uX0X5(X+f8grj?{K?1q^o)}`g)kO?Wc_1gy?6o3yBvNPoU zH2YsufKW*-Kg3t&dWN%{=PDTY!t!35Avft=_+zSMUkE(z&gR#4d0%Z3F)m!wSTc4rj4VICB@ArsotzgQ>c z>m!A0xXrp6*NJwHrds=MEIAw+wmZz$4{}SyO|JU`%h0_ULsh$i$(P>$T?DsNo?-xLUv*pAIUuaoj?DxW6RmRYvcCsx!? zqJQsxuq|E6O?=iSj(F*G)S#&5)AMp9NY)S7j+b&JPJtf*>E9k8mX$d)9D$lj#nBE2?Mfv8`I*hYw; z7V!J=tc76?E6MtF5qX`Le*N4a33YFiFk{Nn14rT zoq+Dq=#s}^Zc(fWfx>~LzynBrZ3 ztwzhYCws$KW*&m2#R(#+GU^t@1>(Ae3$|Tp#%k-LBGW4Zep61sDNKkuJ9@RpSpVOY z)gS0_9N6cE(a6Gc36<^NMw0InKEZCfaZRUP9qnia67DDzz2jQsYO{4%{x{Aof%x=cUl;B# zY!lXD(W^P-p23mefoA1wB!WSN2Gwu;CSh@YfRHJT^KdW|%a5?!*ippX?sbv0_kifc zqjxT?8lPXF6p9|qOb?g0HK%WUpRn(ZGGty$jt|)hiodGU|Wm4GSJ$KRufTC z&!b%9;E}Evv?{1`qQF*-goY@pe{FLFg)J5;x0OK!b#c5vhArcT)$ZSjaaG?xQwTQ3 zHGD1FS-{IL^<)}uIzKd}@JtvjuW?}mhlQ@vS`x($F%%z17r0cBYT`wMN-Q>hu6Ga7 zRaot(=be7DJ~CU3Uoi^RD=mM_-~XjM5CvX)oI23%QSuJXTEV}(G)wiQ#V#-d$R8d% zK2x6bo}Gwci1wi34IOdmmNeN|1hOTi9VAWeh@QkHcb^30G?^J4B&3GsD`}NNYHWx9 z7^I9{oel}BswUQlKH z{k|~?r{^llp6S~ph$81fm>M3Xbf#U=j*{x09ARF{7Bd=bwd&}_^yBy3I>PTh;4}j; z4|xV|sW@0IDKia01Ub1>>cif;K>KBe;fd)n$F0KJQ-ZZe9o`y({aJB`l`|NIXMAbf z5Pa?A;gq_L3sUX1i&q{3=+GBNpy4UZBEZ`Xrd(6*>C3v50Zj}OLee#Y6qgs4+{H| zGU`$h(TO=C{fBk+X-)870DcGPIqC9TzE;pfU@^hIICTP=x9S(Zd zbm=s31T7?DTAl6%NUk(DGRe3kuo%$MkNw z3prswO)F^mWo;tQ+Fq1s`a>>j>i_;3`535XMMIYo=@YpA=5)Kkbkzgf%St})U4v4; zHA1EArq`txqiVX@$luUUSFCS4zEd`Mq}n@x1XH{m*zftt=ZRS1QM@}_hEs(JpChWT z=tK7|WgKFDQNAk~7X$4i)|}l*Y^HnkNZ;j|P9~4VeC2t#2Qr7K{)ASd3VJfVRD8AV z6l&GZ72f3*KlM?C3G0ZVuq4B_=|;jh=~do@wv2v8UL~2cT2B$F>2+SJoZ4D9IPYFP z#}kRX(!961AR1bhnnPBqGJUH;t!!v54k>r9KB=Y0x1ne^HwCppAQQ*>XINOp;)E1z zsf~G&rlIZ5n+Y!;Y4^3#%9&hhDn)#)wwwVhzw)VUn5pG>PTMsSL*HCDRbTFRJ>K32 zIk%=;2oH9&sT=0feWoJKJ97s@;&9Q=TySC^cp?OqO1g59wiQUGkrh$DatI>#&D-`T zZy$PSOcP6^;boXPuius(i@h`7I9N(2xnZMj0DEGC0Jm^VB}zW6ag3*Foyuex77IL- zvaf2+$XuL{pQ8_%y-|si8jG|q3yDEa7#{Y|Ss}iEIiMt@m7Oz@&S{!xCN70$mYEJP z?w`8`66u}%W;dxnP14y(zsjVrVn3uTDLG{v-={pMfXT-6hOs9*(!e*(OQi1tE;TTK z&zBY)6XH{fn8s&L*-3L-JrjT4r3ik6@6F5LapMF2RpJd8`5?iW@_9o@cur6c+|db~ z9^kWj)8RPl^F{qB(RGf`@&<4!SQS`A-RqdgGg0DXZ>n zh=+_|VLofCjPYno9oA4b>ddmisIh7~a_~0eiIRV66VV^~vA8tDc_nv7c`@qXdTH5> zpu82X^Pk_J1U*FCv#(T$RCFzg2f#0PVisn}pNPY_ziHcU9o_xSe3s^mpVo1Z#nHTQ zJGOitjEEPL$1t%C+2r>ClSt*HR=_s98&kyZ=uOK}d0vs3ED@KaT$?V!Z`%B3(xtq< zOO3m^jUUU3=F^qo-JuCjhO`WSWoQr&hI;A$IC{sEs=--CY2e2LLB+I=zQ=E2&|F@N z;wIM_UkoFQHKV-!s813`Rm?ljyW4}aa53!>8H}z4U@H(da?jgi+Uekb;9LR17_g4p z2W$aN{BUfe18F=BGM7Ke;5$E|Zhc6mXZc!c`a$Gv^UB2UqdiaDKagUWHHPg%p ziELMNL6cT4v+PX5DhCEG@G5#8-{%p|4HZXtY=@SRDM8xd5|D?xwJr=o*wdFWrKB?^ zn!=4a(%0C)SbpOxe$Vcv0G@ndvIQxq>1Im}0;yy|F=%G_tgw(YqL76^*=}Uz(GDXvk|UQ0BKdmn-%vWkyXl z6)8O<>U-pS#G{tR|NT*CfUB6Sk}3-x3HbZWPy#yqS_jzrzcr~Wpek$5A{3gThIIL@ z|9>HdZ4VNFXio8u_X^$_XaN8A=3+KC7?1VNqJW;*c=K&F#-C&jOwMwUS$xj;zF`Bk zERaf6mLRCL94Hf5Sf!*ML3d#yW2n=yctnhA`*{*e|2nGJOmv`u88Bmx!;wvBtZ;IeP6 zzZJ_@cAwrDV?Y?9P>;_j)DZY^(7fZUfdR%K>1zwt7Q#Tue z&1{hTWbN1!K15+Q`z3#^_&=)5F8$tnFidxN{cyh2>K4L-;ZWfJIO4Wd1WYAQTaI@D?7t&gGxU1ZZ@F< zC2hJI-`=-@3Saa=FD3_XaNj!x}zzCK^y>?qeFl-~9M+?6zv z=xLDhrUn3B^)aSI+_l&{h0|g(I6Z(<-P`PBH`fEsN2Rql!Z$sE`f{3Oi@Dr`x%uMO#bAm#d1h5*W(ef$uCdG^p(9j2 z2gb<%=OTv@*nw4?L{QzCSLS3n3%*?qkYkGTkM3t65Yfb$yaa*m(?a&?1LZ3AcZ{v< zom}T-I+K(Xk!^(>7g3JTr!~iUk?CnCp4E~X-R-W*Dg8~MLK5uZM9Pj^z&SQ6I9d2h zzv|k}V*i7)%gmNJR%QF@A9f_mo{=*xSpIi3_i>&|j+cI6Y2i&oGNk|j>|0yO^XnAq zzo=jPzzZp6J!P2#Q5#3chld7SaWyp}f$gmV-*qukI~>kYv9YoF+o?Yn1$mz%ut|xE zIW&RDLiSS#=G^nFc+_@o4M*D%+RGwKQ9P@o=Uv`xMe!Y-{8&W==3IFYu5UYSYO8LC znqL`15V-Z0jP^e_*!BGKXl+^IVm%3M?)zqr!N`$tcw(*Httdo)OX8fhOw3!71Pu5P zqvwi@Zbmm%TJ~3~ExOxF%&HaBA<1aOG5Bc#6ZRs$f8I%u6Fe^07U||$yJzX24A;DA z59l+|8a=GFlZyduKWb2~5Y}~Tuu~3s*nRSzcUF`uMPb0VT*I66S!cG?f+Wu#ryWY@TZv5;4PPg2kRFu`N{WpZ-Swkm5}8}Im#%#Itcxq#nC z&cH{S(zwu-%qv@#r}Aa6;H8He(6+RA8p8_b)Ake+|DbCHlX%NO5Io~eTzpCIZ_U`3C8sBE-Fx$yqMaJ9yhPN z3Ehji?$-x>`oqu}{7T(c?g1*n4grKh&JOK+8EIF|qeN^n|KIh3Dm%ckCiOYLt+n8@ z>1ro4Mo6aOTCo3%DWj<5t2gfv8^7+UujY9Slw+)Jihva}!9+~;1w`u}2;j-b%P*H# zi7}%;aqZC#Fm<~6*3Qs34=k@A{1liQ+*KJu3yT0T(-ZZJ3(5ZC;^NCopDSVG+^VXo z@^U^&$%~syI##>9%o#>4iF}SJm4ZfE5vwm)$aNv!BY@ z$`8{kQe|>Xm&`Q^AV5*fJ1?2$^I;NHc;QBBSbrsw+s3ZIGtleFwGp^6fs7U0pTb@} zS}}K=zHW;|5h@(0!^ZpZ=(y#&YImfur86tT2s$2yi|+Ks)e;4zuHuvIMnzF|t}#Jc_f~rD5z) zvP_PrFj8?4#1vE((2aS$=P~nf{#xDaFk6K~;3)BQdm1w?pM9rXroZNqh{M`GMXl)L zcEoO5RW`m%2IMDxsC=h+j`!Hrq-FJ_9w?sTBTRieF>8J4c7k!-t`v&Y57AJ9zhdP| z(e>NR%`h%DTXY+|LwUQz6lBzY#-x>xl{ic3nee9)-`;zL`~B+k*z~mBWjbcXxBPg& uWl&yI2&RGAFjl Date: Tue, 5 Jan 2021 10:12:07 -0800 Subject: [PATCH 059/206] Update bitlocker-csp.md --- windows/client-management/mdm/bitlocker-csp.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index aafdb95416..03a48da95f 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -19,10 +19,6 @@ The BitLocker configuration service provider (CSP) is used by the enterprise to > Settings are enforced only at the time encryption is started. Encryption is not restarted with settings changes. > You must send all the settings together in a single SyncML to be effective. -> [!NOTE] -> Devices that pass Hardware Security Testability Specification (HSTI) validation or Modern -> Standby devices will not be able to configure a Startup PIN using this CSP. Users are required to manually configure the PIN. - A Get operation on any of the settings, except for RequireDeviceEncryption and RequireStorageCardEncryption, returns the setting configured by the admin. @@ -304,6 +300,10 @@ If you disable or do not configure this setting, users can configure only basic > [!NOTE] > If you want to require the use of a startup PIN and a USB flash drive, you must configure BitLocker settings using the command-line tool manage-bde instead of the BitLocker Drive Encryption setup wizard. +> [!NOTE] +> Devices that pass Hardware Security Testability Specification (HSTI) validation or Modern +> Standby devices will not be able to configure a Startup PIN using this CSP. Users are required to manually configure the PIN. + Sample value for this node to enable this policy is: ```xml From fdd1852fae0cd516064caa92f37cca1741cd6a0d Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Tue, 5 Jan 2021 10:31:54 -0800 Subject: [PATCH 060/206] Updated the supplemental-policy.md to be more specific to the supplemental policy creation workflow. --- ...izard-confirm-base-policy-modification.png | Bin 0 -> 39797 bytes .../wdac-wizard-supplemental-not-base.png | Bin 0 -> 41454 bytes ...rd-supplemental-policy-rule-options-UI.png | Bin 0 -> 59172 bytes .../wdac-wizard-create-supplemental-policy.md | 50 ++++++------------ 4 files changed, 17 insertions(+), 33 deletions(-) create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-confirm-base-policy-modification.png create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-supplemental-not-base.png create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-supplemental-policy-rule-options-UI.png diff --git a/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-confirm-base-policy-modification.png b/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-confirm-base-policy-modification.png new file mode 100644 index 0000000000000000000000000000000000000000..17ab235dc3abce3a853eb0956ac8125748eb67ba GIT binary patch literal 39797 zcmcG#RZv{f)-@U+xO)P@-7N(7;M%xLkS4ghYk=VH?(QxP!QHiS*WlW4$vNNuaI3zj zzwUkL>RP?`sv4^R#W(C@!Y(AN6A ze?d7aONxG|n)q_`KKKX}kr(;!p*9-%#R&F&jA$pN<@n(Pmeaov)Vdjo+lLS7NYdX$ zRNeH?z_7Zi%d7BzpAERy&+JAU7tVFt`9y@<_^7PE_t=QkwhP0G;7G%;0fcd&a7B(j z8K!*x#5?i4_5msab4~5w(IDEQK1JLZU5W2j~ICTM~AOCYV@HuUp#N9jPSp zL5uEscIPQ&_NA+*;Z%3!n_t>@bYV5dTlSAY1?tP^xC|Ueq_j6Yu8~!4sJ?H=x~0Pt z1_*}8ub%f*Nj3ev%U#J?cKuvKVO>{JJ&6W8>Lt|&tqf~Dt82)D-a`2ZNUa@Tn)VZ` z9vK<9(AYGgAGnBu-ZYl4MsvRTQwqMSsj>y5esYa0i0-n^ zjUB$~jjlcCHG%v99GVa!KG(;AMhx_~_Ax2ZvKhtajf0UKnN9bVlc&ZQj^slbMYE&9 zj)2^9x6@6K?0xpNae$E);xZLo^UHGOeqwxH@nRl3!}4c@>>vTZP0HN>U(F|Q%#(GV zd%@vl|6ivevE1Z?)N(RGdq6Cx*2~=M4ySXY$MPb8G47J~Wo7)Y0CT#EtkhWKrcQH} z2kdmUS~g#;5G`$4UK~1dS-T2`XbCJ84UIvUSLzYQOb!a?T8o*VmVKc%%i`Bip+G|O z0F93afgiU$zxxzz&4Oee_hl#aZnWBj(g^!Yhi}lrB04<~f1F&FkFO^ zcLfo=D1-1GUvr~L3=oSVf*u}44yYFo$UU6_pWGe+BTPcS%G-?&Y{gCf1nD!Z#l5$fE-pFmF@*ShH(IK>^ib}0_L5j&KC?E=_Uivc7FGoJBfuz2e zn6L(U_^OGR_I!o>=i78Hz1Rm;_NHx zW#KT_Nr1}B>78`<=w zl$=a{2b;CKzw9=;m9qXo80OhUxN5kMPjJ%^{zK7ekh>5o)J#70$xGrx`@y6z=7Zkf zP~z26+2|B9e}gG8c$nX`viWs4 z(oRZ`{8Va6ESQ{1-5QFf7m#i_rnYQoMpfOAp!+6r{SlqPomu)=$R=YEwr^;kJ zVEJdcnwL$4LqXwfeHi$CGRYGg>14T4g{ChqCx*~_O9}y8O8*NvY>0Xp6SzYvT{bH) zAs%=9<$gz>%ND%kzJ^c0-{v&Ha=PMfumMfY=Tg1)p|h}H6&P@_7kdRP_7V#Wg!!&p zf$=sA-&>{EjieTfcw>h+33&)B&-K5@3NGO7N2}+OgPJP>IDo!X4SOnVH81@H;F6UCj?Gv1!)G zG-TrYqTS)wTlNpeo%FQ|J09M{CrGc;;p~+|Ird`j$eD?edlzl2pvdM3!z!93>oQVi zTl}$hv~1Plm(^B&#Fj36(z>4Wo`m&gnCSFQge!ZQw0qSv;yr_Z*H5Y`aqqU18|Nm0 zlSEfgr>+Coc=jkKU4zA71Pe$1?_G!c$$~%34eYw(m`q$;!_&W%?fpPXZ7>jNnT6-+ zs3dMWE>c~=;m^Mj6M&rTDB#6@FX%PzsUyUMe|$T8Ma%OM|A^iYNJ4CD?>rWXfzd>c((*7TJIs5D79QV=L# zh>oK(Zo;kq_C+%rI)J0Baq_TCv74*AKF!JQj}h7fFJ19reFUM5XA+&ARj!KtOcBu7 zkUAAS9=)`Co&X`1@-&H+s}l`~y8L+G6+w4p;*7lwz#PZ}GWKifK(~|(F(7`exP+uN zj}lKFBJOykjllh_9r_^pB(E!)u8RSHAnrYwDE)ctQI(!+>H|^6PRmvM73<;bU{4^S zFhZ_kS_Aw6I?mp%&IIcGh``Ac?k>t%J436Jyq;YbKhp6&%1dk|LG2GoVAG!=qd~{I z6}x$y+tE!cObs32)}QJYemFQlg za$CZAu6SdT5xwO!=+PPM(58~GQ%P`$8EyS0z{k~YtZ{_d2-0%p;l26;-2^2L!P!3h z4zNBn`|WE;&DHAQ4ga;>b&lwAhXB0#YNHA?SUX&o4^;$`fXZCbd+d4nXI7PD zxLF%_VW}CBZ`@nMpuBQ5N*}(tXZH5Wm+A5E_VSA6c+%)`G<;<3smjKv0r41acT?tA zJFjz-@%XH21u){JL{b#w7s>Y={}RLBagm?|lS(Zv-<7EiGS(<&C^Y^ok@Tc=f4L&kG4qXts$=1OBwedlO$xdFj`PRW<^wh}T4K`yL8F0>EG~LN**-8)`Cio*yk*4XyKv&pxip^_o)or;!U?es(thU7a+lfWGy1DW6f#`q-P zPOlG0#hG;G*)e!^ZN68wZBn}H=lwu@+zTaB zA{GH0*-0v&9sN8hU)^Hp#H5MYRz5)*O(2 zL3_-ma~UTAdc2~<$Vh`HW)pW9H`F%2sRg@Nv_#>PY;3AV35`wKXW=m0LQ*} zcS;Ad`=YKz0fz=`_z}k3sVGysG_iHsx}hp!#*wUGamh}quDFC39NE@X_fE*kGJpQ< zci`O>71?64GWctYLnS^)dI$?a?6}^D`dlgGG?%4+VY_fjBY}(7C9R6PJ)Hp3v`QLE z7jHKCWZwqE(Uqlf;|E1)i&~VWfHpT9Sumn(p}ikKw6{vaFZFe zEGoG^jkuz+pfHyvEnH2xl)5M$!jqv67gx)#$Jpw4*op7dsePLt50?@uCwh0ohu5==MUI&SA4n(xa*GMHE zhY|p%Nj2i8X#**#+c&`6eIQO|=E0i;UjAC&2xvtOW8u z_=EDgj*m8XO<19lo=rciESm$nHYSJ3gOrd#vWvp7$DATm)TM*|i(Y6H^Fx`P(|jr6%o+HNRj=GOwMF z&o3bHwC$TqVQ~rnijKHEzh+zWhZ)iTd;R|Z6NvwZHu!x6rDkU84fsK8+=BZ4 z5sSIHG=dCwclRj|92g`jDyqN9lLwCZCz#1<5y%e94mSQRZE|BtZ`l8#Cfe%p0re#% zv>Y7Q^^=16pEi8oAa$mrIh#8>v$T9_Lf5E4y0z;!<^i_CIUL+KD3T>FEtg zJ*20k4DD0l+}zyc0dTr10}T2*UyP)YSd>-aH8pX`Fqub$|nZ`_UdipX;;+N`q1ZAh#CoA@Lv)=?ZT^D6xAnBjqZ94{ny(wZcdG)K$ zT+3XxTwpalw(&Hc(SF=JIOftqI1gG!p2+n|UT?%NL~!<;0xREn_YH}gtlgDc$H8Q_ zBhV>aMp3c2xD+-&2Wl|^3RDVCo)N_9g9DC{S(jC#$>m+*i#Mj$n$&)l+au7r8q$v%qQxUA*(CQaGW% z4||&2CMOpk^f+|Zt{<_b?zs83lzH7JZ2Z)?vTb+HG&DzYLt}K!>r z$i>vu;zqgW7LgF_=sk7uls?sX-@2LcfZMMR_(t#mv$}aB2w%oA8-mf^l@QF*Rf$Lz zw4UD#e=u9DxQzX^#q-|A-JOR^7{FQvu!9~_kdkjgS*F8ct@blJKoAf9QJa!2+3X9* zj@O}O%t6-TA;(;89oxtMm1Am@TasFen1+)yu9?!6b zszc;Qb zpFKE?zr5y3aIcY0qSb;*m;BpQC93#-=d@|F?PT*)?VZulXE7Hm&sED&i6Z3Q?=gW8 zNeL`1_V)Hnfj|unjru^A;{DJfX;A6g=CLC}%h5;T@LrM|nwk|n_~K}Z>YYVq8!D9?p4B$rm3E~gC~>y;HI>J^qK zSh4NZOx(|M#Wn0WgWU5&KHV1GL<4J3%{jSBZ1=u;c)!LFzUPyhE<-!4>=sd(>pj;U zyRV8sW#p8Toa(%pRDwK{c9SD4u>aInhJqC4$KuDh`EPh>N}ArGOQTLPT&xD21H^D7 z7n{mfbFg`! zdWF}}*3r??N?WzP+$sBG57)-4GdTd%QLfLQrqUinvIRKxp`wP z2R$8|%{LuiqssYDKWM7QFTLi@F(ZrFMKOFSO(!HIM3#%#5N^mO*Z>c% z>0MDsPgelh^k_Te)-vlwtej1^Hn_v=pnDrM^<})3CF)ZYNm0os{pa~aEWp`AUpe0D zTxGedVrO69CaU(U&-XVplnFB)%URRjGE1k@?aQi7lcIA}HzIAW2kQH`INHN%9%kKE z|7}#l)a-BNgNsf*cbZi%W|J(Qx(Bg2?ty7bU4pi=WH#v16Ok$)#9-ZdOI>|-i=9 ## Configuring Policy Rules diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md index 399ff347f0..3c662ab399 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md @@ -25,7 +25,7 @@ ms.date: 10/14/2020 - Windows 10 - Windows Server 2016 and above -The Windows Defender Application Control (WDAC) policy Wizard is an open source Windows desktop application written in C# and bundled as an MSIX pacakge. The Wizard was built to provide security architects, security and system administrators with a more user-friendly means to create, edit, and merge WDAC policies. The Wizard desktop application uses the [ConfigCI PowerShell Cmdlets](https://docs.microsoft.com/powershell/module/configci/?view=win10-ps) in the backend so the output policy of the Wizard and PowerShell cmdlets is identical. +The Windows Defender Application Control (WDAC) policy Wizard is an open source Windows desktop application written in C# and bundled as an MSIX pacakge. The Wizard was built to provide security architects, security and system administrators with a more user-friendly means to create, edit, and merge WDAC policies. The Wizard desktop application uses the [ConfigCI PowerShell Cmdlets](https://docs.microsoft.com/powershell/module/configci) in the backend so the output policy of the Wizard and PowerShell cmdlets is identical. ## Downloading the application From 6e2c901c5414c3baa394adf0fd5d01bcd1226dfc Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 5 Jan 2021 11:23:05 -0800 Subject: [PATCH 063/206] Update windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../microsoft-defender-atp/attack-surface-reduction.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 212256ae38..6224bb44dc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -245,9 +245,9 @@ GUID: `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` > [!NOTE] > The rule **Block executable content from email client and webmail** has the following alternative descriptions, depending on which application you use: -- > Intune (Configuration Profiles): Execution of executable content (exe, dll, ps, js, vbs, etc.) dropped from email (webmail/mail client) (no exceptions). -- > Endpoint Manager: Block executable content download from email and webmail clients. -- > Group Policy: Block executable content from email client and webmail. +> - Intune (Configuration Profiles): Execution of executable content (exe, dll, ps, js, vbs, etc.) dropped from email (webmail/mail client) (no exceptions). +> - Endpoint Manager: Block executable content download from email and webmail clients. +> - Group Policy: Block executable content from email client and webmail. ### Block executable files from running unless they meet a prevalence, age, or trusted list criterion From 9376aa6a6af47570b607021d885e7fc0ec0f313f Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 5 Jan 2021 13:53:42 -0800 Subject: [PATCH 064/206] update live response page --- .../microsoft-defender-atp/live-response.md | 31 +++++++++++-------- 1 file changed, 18 insertions(+), 13 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index 193c067a32..59e886e92d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -43,25 +43,30 @@ With live response, analysts can do all of the following tasks: Before you can initiate a session on a device, make sure you fulfill the following requirements: -- **Verify that you're running a supported version of Windows 10**.
    -Devices must be running one of the following versions of Windows 10: - - [1909](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1909) or later - - [1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) - - [1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809) - - [1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803) - - [1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) +- **Verify that you're running a supported version of Windows**.
    +Devices must be running one of the following versions of Windows -- **Make sure to install appropriate security updates**.
    - - 1903: [KB4515384](https://support.microsoft.com/help/4515384/windows-10-update-kb4515384) - - 1809 (RS5): [KB4537818](https://support.microsoft.com/help/4537818/windows-10-update-kb4537818) - - 1803 (RS4): [KB4537795](https://support.microsoft.com/help/4537795/windows-10-update-kb4537795) - - 1709 (RS3): [KB4537816](https://support.microsoft.com/help/4537816/windows-10-update-kb4537816) + - **Windows 10** + - [Version 1909](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1909) or later + - [Version 1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) with [KB4515384](https://support.microsoft.com/en-us/help/4515384/windows-10-update-kb4515384) + - [Version 1809 (RS 5)](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809) with [with KB4537818](https://support.microsoft.com/help/4537818/windows-10-update-kb4537818) + - [Version 1803 (RS 4)](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803) with [KB4537795](https://support.microsoft.com/help/4537795/windows-10-update-kb4537795) + - [Version 1709 (RS 3)](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) with [KB4537816](https://support.microsoft.com/help/4537816/windows-10-update-kb4537816) + + - **Windows Server 2019 - Only applicable for Public preview** + - Version 1903 or (with [KB4515384](https://support.microsoft.com/en-us/help/4515384/windows-10-update-kb4515384)) later + - Version 1809 (with [KB4537818](https://support.microsoft.com/en-us/help/4537818/windows-10-update-kb4537818)) -- **Enable live response from the settings page**.
    +- **Enable live response from the advanced settings page**.
    You'll need to enable the live response capability in the [Advanced features settings](advanced-features.md) page. >[!NOTE] >Only users with manage security or global admin roles can edit these settings. + +- **Enable live response for servers from the advanced settings page** (recommended).
    + + >[!NOTE] + >Only users with manage security or global admin roles can edit these settings. - **Ensure that the device has an Automation Remediation level assigned to it**.
    You'll need to enable, at least, the minimum Remediation Level for a given Device Group. Otherwise you won't be able to establish a Live Response session to a member of that group. From 2967b9c0394b3e88675aa292fa1047df241dd3f7 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 5 Jan 2021 13:55:10 -0800 Subject: [PATCH 065/206] add description in advanced settings page --- .../microsoft-defender-atp/advanced-features.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md index 725daf0761..50b285cef4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md @@ -42,6 +42,12 @@ Turn on this feature so that users with the appropriate permissions can start a For more information about role assignments, see [Create and manage roles](user-roles.md). +## Live response for servers +Turn on this feature so that users with the appropriate permissions can start a live response session on servers. + +For more information about role assignments, see [Create and manage roles](user-roles.md). + + ## Live response unsigned script execution Enabling this feature allows you to run unsigned scripts in a live response session. From d11f2ac409ca3a234724a010bab0bf4d9f795e17 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 5 Jan 2021 16:19:25 -0800 Subject: [PATCH 066/206] Added bullets and spacing for readbility --- .../whats-new-windows-10-version-2004.md | 32 ++++++++++++------- 1 file changed, 21 insertions(+), 11 deletions(-) diff --git a/windows/whats-new/whats-new-windows-10-version-2004.md b/windows/whats-new/whats-new-windows-10-version-2004.md index f8c9549d00..38d51da399 100644 --- a/windows/whats-new/whats-new-windows-10-version-2004.md +++ b/windows/whats-new/whats-new-windows-10-version-2004.md @@ -30,8 +30,11 @@ To download and install Windows 10, version 2004, use Windows Update (**Settings ### Windows Hello - Windows Hello is now supported as Fast Identity Online 2 (FIDO2) authenticator across all major browsers including Chrome and Firefox. + - You can now enable passwordless sign-in for Microsoft accounts on your Windows 10 device by going to **Settings > Accounts > Sign-in options**, and selecting **On** under **Make your device passwordless**. Enabling passwordless sign in will switch all Microsoft accounts on your Windows 10 device to modern authentication with Windows Hello Face, Fingerprint, or PIN. + - Windows Hello PIN sign-in support is [added to Safe mode](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#windows-hello-pin-in-safe-mode-build-18995). + - Windows Hello for Business now has Hybrid Azure Active Directory support and phone number sign-in (MSA). FIDO2 security key support is expanded to Azure Active Directory hybrid environments, enabling enterprises with hybrid environments to take advantage of [passwordless authentication](https://docs.microsoft.com/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). For more information, see [Expanding Azure Active Directory support for FIDO2 preview to hybrid environments](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/expanding-azure-active-directory-support-for-fido2-preview-to/ba-p/981894). ### Windows Defender System Guard @@ -84,7 +87,7 @@ Also see [What's new in Microsoft Intune](https://docs.microsoft.com/mem/intune/ ### Windows Assessment and Deployment Toolkit (ADK) -Download the Windows ADK and Windows PE add-on for Windows 10, version 2004 [here](https://docs.microsoft.com/windows-hardware/get-started/adk-install). +Download the Windows ADK and Windows PE add-on for Windows 10, version 2004 here: [Download and install the Windows ADK](https://docs.microsoft.com/windows-hardware/get-started/adk-install). For information about what's new in the ADK, see [What's new in the Windows ADK for Windows 10, version 2004](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-windows-adk-for-windows-10-version-2004). @@ -120,8 +123,11 @@ The following [Delivery Optimization](https://docs.microsoft.com/windows/deploym ### Windows Update for Business [Windows Update for Business](https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb) enhancements in this release include: + - Intune console updates: target version is now available allowing you to specify which version of Windows 10 you want devices to move to. Additionally, this capability enables you to keep devices on their current version until they reach end of service. Check it out in Intune, also available as a Group Policy and Configuration Service Provider (CSP) policy. + - Validation improvements: To ensure devices and end users stay productive and protected, Microsoft uses safeguard holds to block devices from updating when there are known issues that would impact that device. Also, to better enable IT administrators to validate on the latest release, we have created a new policy that enables admins to opt devices out of the built-in safeguard holds. + - Update less: Last year, we [changed update installation policies](https://blogs.windows.com/windowsexperience/2019/04/04/improving-the-windows-10-update-experience-with-control-quality-and-transparency/#l2jH7KMkOkfcWdBs.97) for Windows 10 to only target devices running a feature update version that is nearing end of service. As a result, many devices are only updating once a year. To enable all devices to make the most of this policy change, and to prevent confusion, we have removed deferrals from the Windows Update settings **Advanced Options** page starting on Windows 10, version 2004. If you wish to continue leveraging deferrals, you can use local Group Policy (**Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview builds and Feature Updates are received** or **Select when Quality Updates are received**). For more information about this change, see [Simplified Windows Update settings for end users](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplified-windows-update-settings-for-end-users/ba-p/1497215). ## Networking @@ -185,9 +191,13 @@ Several enhancements to the Windows 10 user interface are implemented in this re ### Cortana [Cortana](https://www.microsoft.com/cortana) has been updated and enhanced in Windows 10, version 2004: + - Productivity: chat-based UI gives you the ability to [interact with Cortana using typed or spoken natural language queries](https://support.microsoft.com/help/4557165) to easily get information across Microsoft 365 and stay on track. Productivity focused capabilities such as finding people profiles, checking schedules, joining meetings, and adding to lists in Microsoft To Do are currently available to English speakers in the US. + - In the coming months, with regular app updates through the Microsoft Store, we’ll enhance this experience to support wake word invocation and enable listening when you say “Cortana,” offer more productivity capabilities such as surfacing relevant emails and documents to help you prepare for meetings, and expand supported capabilities for international users. + - Security: tightened access to Cortana so that you must be securely logged in with your work or school account or your Microsoft account before using Cortana. Because of this tightened access, some consumer skills including music, connected home, and third-party skills will no longer be available. Additionally, users [get cloud-based assistance services that meet Office 365’s enterprise-level privacy, security, and compliance promises](https://docs.microsoft.com/microsoft-365/admin/misc/cortana-integration?view=o365-worldwide) as set out in the Online Services Terms. + - Move the Cortana window: drag the Cortana window to a more convenient location on your desktop. For updated information, see the [Microsoft 365 blog](https://aka.ms/CortanaUpdatesMay2020). @@ -246,13 +256,13 @@ For information about Desktop Analytics and this release of Windows 10, see [Wha ## See Also -[What’s new for IT pros in Windows 10, version 2004](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/what-s-new-for-it-pros-in-windows-10-version-2004/ba-p/1419764): Windows IT Pro blog.
    -[What’s new in the Windows 10 May 2020 Update](https://blogs.windows.com/windowsexperience/2020/05/27/whats-new-in-the-windows-10-may-2020-update/): Windows Insider blog.
    -[What's New in Windows Server](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server): New and updated features in Windows Server.
    -[Windows 10 Features](https://www.microsoft.com/windows/features): General information about Windows 10 features.
    -[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.
    -[Start developing on Windows 10, version 2004 today](https://blogs.windows.com/windowsdeveloper/2020/05/12/start-developing-on-windows-10-version-2004-today/): New and updated features in Windows 10 that are of interest to developers.
    -[What's new for business in Windows 10 Insider Preview Builds](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new): A preview of new features for businesses.
    -[What's new in Windows 10, version 2004 - Windows Insiders](https://docs.microsoft.com/windows-insider/at-home/whats-new-wip-at-home-20h1): This list also includes consumer focused new features.
    -[Features and functionality removed in Windows 10](https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features): Removed features.
    -[Windows 10 features we’re no longer developing](https://docs.microsoft.com/windows/deployment/planning/windows-10-deprecated-features): Features that are not being developed.
    + - [What’s new for IT pros in Windows 10, version 2004](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/what-s-new-for-it-pros-in-windows-10-version-2004/ba-p/1419764): Windows IT Pro blog.
    + - [What’s new in the Windows 10 May 2020 Update](https://blogs.windows.com/windowsexperience/2020/05/27/whats-new-in-the-windows-10-may-2020-update/): Windows Insider blog.
    + - [What's New in Windows Server](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server): New and updated features in Windows Server.
    + - [Windows 10 Features](https://www.microsoft.com/windows/features): General information about Windows 10 features.
    + - [What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.
    + - [Start developing on Windows 10, version 2004 today](https://blogs.windows.com/windowsdeveloper/2020/05/12/start-developing-on-windows-10-version-2004-today/): New and updated features in Windows 10 that are of interest to developers.
    + - [What's new for business in Windows 10 Insider Preview Builds](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new): A preview of new features for businesses.
    + - [What's new in Windows 10, version 2004 - Windows Insiders](https://docs.microsoft.com/windows-insider/at-home/whats-new-wip-at-home-20h1): This list also includes consumer focused new features.
    + - [Features and functionality removed in Windows 10](https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features): Removed features.
    + - [Windows 10 features we’re no longer developing](https://docs.microsoft.com/windows/deployment/planning/windows-10-deprecated-features): Features that are not being developed.
    From d0dfadfc0882faa806f82ca511b7d0747633a36b Mon Sep 17 00:00:00 2001 From: katoma2017 <48699113+katoma2017@users.noreply.github.com> Date: Tue, 5 Jan 2021 16:46:04 -0800 Subject: [PATCH 067/206] Update security-compliance-toolkit-10.md Add the update baseline to the security baseline toolkit --- .../threat-protection/security-compliance-toolkit-10.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/threat-protection/security-compliance-toolkit-10.md b/windows/security/threat-protection/security-compliance-toolkit-10.md index e8dd6ab29f..e8972cbc75 100644 --- a/windows/security/threat-protection/security-compliance-toolkit-10.md +++ b/windows/security/threat-protection/security-compliance-toolkit-10.md @@ -47,6 +47,9 @@ The Security Compliance Toolkit consists of: - Microsoft Edge security baseline - Version 85 + + - Windows Update security baseline + - Windows 10 20H2 and below (October 2020 Update) - Tools - Policy Analyzer tool From 92fc72fae38caa31ea5ca967cea2914d03a35b4e Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 5 Jan 2021 16:49:16 -0800 Subject: [PATCH 068/206] Minor fixes and Acrolinx "Italized" --- .../wdac-wizard-create-base-policy.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md index 277a5b28a2..f911c0979d 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md @@ -32,13 +32,13 @@ When creating policies for use with Windows Defender Application Control (WDAC), Each of the template policies has a unique set of policy allow list rules that will affect the circle-of-trust and security model of the policy. The following table lists the policies in increasing order of trust and freedom. For instance, the Default Windows mode policy trusts fewer application publishers and signers than the Signed and Reputable mode policy. The Default Windows policy will have a smaller circle-of-trust with better security than the Signed and Reputable policy, but at the expense of compatibility. -| **Template Base Policy** | **Description** | +| Template Base Policy | Description | |---------------------------------|-------------------------------------------------------------------| | **Default Windows Mode** | Default Windows mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](https://docs.microsoft.com/windows-hardware/drivers/install/whql-release-signature)
    | | **Allow Microsoft Mode** | Allow mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](https://docs.microsoft.com/windows-hardware/drivers/install/whql-release-signature)
    • *All Microsoft-signed software*
    | | **Signed and Reputable Mode** | Signed and Reputable mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](https://docs.microsoft.com/windows-hardware/drivers/install/whql-release-signature)
    • All Microsoft-signed software
    • *Files with good reputation per [Microsoft Defender's Intelligent Security Graph technology](use-windows-defender-application-control-with-intelligent-security-graph.md)*
    | -*Italized content denotes the changes in the current policy with respect to the policy prior.* +*Italicized content denotes the changes in the current policy with respect to the policy prior.* More information about the Default Windows Mode and Allow Microsoft Mode policies can be accessed through the [Example WDAC base policies article](example-wdac-base-policies.md). @@ -67,7 +67,8 @@ A description of each policy rule, beginning with the left-most column, is provi | **Unsigned System Integrity Policy** | Allows the policy to remain unsigned. When this option is removed, the policy must be signed and have UpdatePolicySigners added to the policy to enable future policy modifications. | | **User Mode Code Integrity** | WDAC policies restrict both kernel-mode and user-mode binaries. By default, only kernel-mode binaries are restricted. Enabling this rule option validates user mode executables and scripts. | -![Rule options UI for Windows Allowed mode policy](images/wdac-wizard-rule-options-UI-advanced-collapsed.png) +> [!div class="mx-imgBorder"] +> ![Rule options UI for Windows Allowed mode policy](images/wdac-wizard-rule-options-UI-advanced-collapsed.png) ### Advanced Policy Rules Description @@ -120,8 +121,8 @@ The Wizard supports the creation of [file name rules](select-types-of-rules-to-c | **Product name** | Specifies the name of the product with which the binary ships. | | **Internal name** | Specifies the internal name of the binary. | - -![Custom file attributes rule](images/wdac-wizard-custom-file-attribute-rule.png) +> [!div class="mx-imgBorder"] +> ![Custom file attributes rule](images/wdac-wizard-custom-file-attribute-rule.png) ### File Hash Rules From 0a4079fdf4fd86f28f0adf4511f6191210b68937 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 5 Jan 2021 16:51:02 -0800 Subject: [PATCH 069/206] Acrolinx: "pacakge" --- .../windows-defender-application-control/wdac-wizard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md index 3c662ab399..0232249e8a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md @@ -25,7 +25,7 @@ ms.date: 10/14/2020 - Windows 10 - Windows Server 2016 and above -The Windows Defender Application Control (WDAC) policy Wizard is an open source Windows desktop application written in C# and bundled as an MSIX pacakge. The Wizard was built to provide security architects, security and system administrators with a more user-friendly means to create, edit, and merge WDAC policies. The Wizard desktop application uses the [ConfigCI PowerShell Cmdlets](https://docs.microsoft.com/powershell/module/configci) in the backend so the output policy of the Wizard and PowerShell cmdlets is identical. +The Windows Defender Application Control (WDAC) policy Wizard is an open source Windows desktop application written in C# and bundled as an MSIX package. The Wizard was built to provide security architects, security and system administrators with a more user-friendly means to create, edit, and merge WDAC policies. The Wizard desktop application uses the [ConfigCI PowerShell Cmdlets](https://docs.microsoft.com/powershell/module/configci) in the backend so the output policy of the Wizard and PowerShell cmdlets is identical. ## Downloading the application From 85f66153f659cfc3feb4fb2d0d9895d30242a34c Mon Sep 17 00:00:00 2001 From: ShowMeMore Date: Wed, 6 Jan 2021 16:45:56 +0100 Subject: [PATCH 070/206] Update minimum-requirements.md Updated licensing requirements match academic licensing: - Added Microsoft 365 A5 Security to the list of licensing requirements for Microsoft Defender for Endpoint - Added Microsoft 365 A5 Security to the note for Microsoft Defender for Endpoint for Servers --- .../microsoft-defender-atp/minimum-requirements.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md b/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md index 8605eac87e..96515f8a95 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md +++ b/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md @@ -39,8 +39,9 @@ Microsoft Defender for Endpoint requires one of the following Microsoft volume l - Windows 10 Enterprise E5 - Windows 10 Education A5 - Microsoft 365 E5 (M365 E5) which includes Windows 10 Enterprise E5 -- Microsoft 365 E5 Security - Microsoft 365 A5 (M365 A5) +- Microsoft 365 E5 Security +- Microsoft 365 A5 Security > [!NOTE] > Eligible licensed users may use Microsoft Defender for Endpoint on up to five concurrent devices. @@ -57,7 +58,7 @@ Microsoft Defender for Endpoint, on Windows Server, requires one of the followin > * Microsoft Defender for Endpoint > * Windows E5/A5 > * Microsoft 365 E5/A5 -> * Microsoft 365 E5 Security +> * Microsoft 365 E5/A5 Security For detailed licensing information, see the [Product Terms site](https://www.microsoft.com/licensing/terms/) and work with your account team to learn more about the terms and conditions. From 5547d1d461653e0fe57b7bd77ed99251c8e52e3e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 09:54:04 -0800 Subject: [PATCH 071/206] antivirus platform updates started section for older versions --- ...on-updates-microsoft-defender-antivirus.md | 2 +- ...-baselines-microsoft-defender-antivirus.md | 265 ++++++++++++++++++ 2 files changed, 266 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md index 613d0bb3b1..7dcee83d5a 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md @@ -1,5 +1,5 @@ --- -title: Manage how and where Microsoft Defender AV receives updates +title: Manage how and where Microsoft Defender Antivirus receives updates description: Manage the fallback order for how Microsoft Defender Antivirus receives protection updates. keywords: updates, security baselines, protection, fallback order, ADL, MMPC, UNC, file path, share, wsus search.product: eADQiWindows 10XVcnh diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index 9700678379..e5bb66a2ff 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -336,6 +336,271 @@ When this update is installed, the device needs the jump package 4.10.2001.10 to
    +### Previous version updates: Technical upgrade support only + +
    + + +
    + November-2020 (Platform: 4.18.2011.6 | Engine: 1.1.17700.4) + + Security intelligence update version: **1.327.1854.0** + Released: **December 03, 2020** + Platform: **4.18.2011.6** + Engine: **1.1.17700.4** + Support phase: **Security and Critical Updates** + +### What's new +- Improved SmartScreen status support logging +- Apply CPU throttling policy to manually initiated scans + +### Known Issues +No known issues +
    +
    + October-2020 (Platform: 4.18.2010.7 | Engine: 1.1.17600.5) + + Security intelligence update version: **1.327.7.0** + Released: **October 29, 2020** + Platform: **4.18.2010.7** + Engine: **1.1.17600.5** + Support phase: **Security and Critical Updates** + +### What's new +- New descriptions for special threat categories +- Improved emulation capabilities +- Improved host address allow/block capabilities +- New option in Defender CSP to Ignore merging of local user exclusions + +### Known Issues +No known issues +
    +
    + September-2020 (Platform: 4.18.2009.7 | Engine: 1.1.17500.4) + + Security intelligence update version: **1.325.10.0** + Released: **October 01, 2020** + Platform: **4.18.2009.7** + Engine: **1.1.17500.4** + Support phase: **Security and Critical Updates** + +### What's new +- Admin permissions are required to restore files in quarantine +- XML formatted events are now supported +- CSP support for ignoring exclusion merges +- New management interfaces for: + - UDP Inspection + - Network Protection on Server 2019 + - IP Address exclusions for Network Protection +- Improved visibility into TPM measurements +- Improved Office VBA module scanning + +### Known Issues +No known issues +
    +
    +
    + August-2020 (Platform: 4.18.2008.9 | Engine: 1.1.17400.5) + + Security intelligence update version: **1.323.9.0** + Released: **August 27, 2020** + Platform: **4.18.2008.9** + Engine: **1.1.17400.5** + Support phase: **Security and Critical Updates** + +### What's new + +- Add more telemetry events +- Improved scan event telemetry +- Improved behavior monitoring for memory scans +- Improved macro streams scanning +- Added `AMRunningMode` to Get-MpComputerStatus PowerShell cmdlet +- [DisableAntiSpyware](https://docs.microsoft.com/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware) is ignored. Microsoft Defender Antivirus automatically turns itself off when it detects another antivirus program. + + +### Known Issues +No known issues +
    +
    + +
    + July-2020 (Platform: 4.18.2007.8 | Engine: 1.1.17300.4) + + Security intelligence update version: **1.321.30.0** + Released: **July 28, 2020** + Platform: **4.18.2007.8** + Engine: **1.1.17300.4** + Support phase: **Security and Critical Updates** + +### What's new +* Improved telemetry for BITS +* Improved Authenticode code signing certificate validation + +### Known Issues +No known issues +
    +
    + +
    + June-2020 (Platform: 4.18.2006.10 | Engine: 1.1.17200.2) + + Security intelligence update version: **1.319.20.0** + Released: **June 22, 2020** + Platform: **4.18.2006.10** + Engine: **1.1.17200.2** + Support phase: **Technical upgrade Support (Only)** + +### What's new +* Possibility to specify the [location of the support logs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data) +* Skipping aggressive catchup scan in Passive mode. +* Allow Defender to update on metered connections +* Fixed performance tuning when caching is disabled +* Fixed registry query +* Fixed scantime randomization in ADMX + +### Known Issues +No known issues +
    +
    + +
    + May-2020 (Platform: 4.18.2005.4 | Engine: 1.1.17100.2) + + Security intelligence update version: **1.317.20.0** + Released: **May 26, 2020** + Platform: **4.18.2005.4** + Engine: **1.1.17100.2** + Support phase: **Technical upgrade Support (Only)** + +### What's new +* Improved logging for scan events +* Improved user mode crash handling. +* Added event tracing for Tamper protection +* Fixed AMSI Sample submission +* Fixed AMSI Cloud blocking +* Fixed Security update install log + +### Known Issues +No known issues +
    +
    + +
    + April-2020 (Platform: 4.18.2004.6 | Engine: 1.1.17000.2) + + Security intelligence update version: **1.315.12.0** + Released: **April 30, 2020** + Platform: **4.18.2004.6** + Engine: **1.1.17000.2** + Support phase: **Technical upgrade Support (Only)** + +### What's new +* WDfilter improvements +* Add more actionable event data to attack surface reduction detection events +* Fixed version information in diagnostic data and WMI +* Fixed incorrect platform version in UI after platform update +* Dynamic URL intel for Fileless threat protection +* UEFI scan capability +* Extend logging for updates + +### Known Issues +No known issues +
    +
    + +
    + March-2020 (Platform: 4.18.2003.8 | Engine: 1.1.16900.2) + + Security intelligence update version: **1.313.8.0** + Released: **March 24, 2020** + Platform: **4.18.2003.8** + Engine: **1.1.16900.4** + Support phase: **Technical upgrade Support (Only)** + +### What's new + +* CPU Throttling option added to [MpCmdRun](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus) +* Improve diagnostic capability +* reduce Security intelligence timeout (5 min) +* Extend AMSI engine internal log capability +* Improve notification for process blocking + +### Known Issues +[**Fixed**] Microsoft Defender Antivirus is skipping files when running a scan. + +
    +
    + +
    + + February-2020 (Platform: - | Engine: 1.1.16800.2) + + + Security intelligence update version: **1.311.4.0** + Released: **February 25, 2020** + Platform/Client: **-** + Engine: **1.1.16800.2** + Support phase: **N/A** + +### What's new + + +### Known Issues +No known issues +
    +
    + +
    + January-2020 (Platform: 4.18.2001.10 | Engine: 1.1.16700.2) + + +Security intelligence update version: **1.309.32.0** +Released: **January 30, 2020** +Platform/Client: **4.18.2001.10** +Engine: **1.1.16700.2** +Support phase: **Technical upgrade Support (Only)** + +### What's new + +* Fixed BSOD on WS2016 with Exchange +* Support platform updates when TMP is redirected to network path +* Platform and engine versions are added to [WDSI](https://www.microsoft.com/wdsi/defenderupdates) +* extend Emergency signature update to [passive mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility) +* Fix 4.18.1911.3 hang + +### Known Issues +[**Fixed**] devices utilizing [modern standby mode](https://docs.microsoft.com/windows-hardware/design/device-experiences/modern-standby) may experience a hang with the Windows Defender filter driver that results in a gap of protection. Affected machines appear to the customer as having not updated to the latest antimalware platform. +
    +> [!IMPORTANT] +> This updates is needed by RS1 devices running lower version of the platform to support SHA2.
    This update has reboot flag for systems that are experiencing the hang issue.
    the This update is re-released in April 2020 and will not be superseded by newer updates to keep future availability. +
    +> [!IMPORTANT] +> This update is categorized as an "update" due to its reboot requirement and will only be offered with a [Windows Update](https://support.microsoft.com/help/4027667/windows-10-update) +
    +
    + +
    + November-2019 (Platform: 4.18.1911.3 | Engine: 1.1.16600.7) + +Security intelligence update version: **1.307.13.0** +Released: **December 7, 2019** +Platform: **4.18.1911.3** +Engine: **1.1.17000.7** +Support phase: **No support** + +### What's new + +* Fixed MpCmdRun tracing level +* Fixed WDFilter version info +* Improve notifications (PUA) +* add MRT logs to support files + +### Known Issues +When this update is installed, the device needs the jump package 4.10.2001.10 to be able to update to the latest platform version. +
    +
    + + ## Microsoft Defender Antivirus platform support Platform and engine updates are provided on a monthly cadence. To be fully supported, keep current with the latest platform updates. Our support structure is dynamic, evolving into two phases depending on the availability of the latest platform version: From 2e112248e6888198bc74baf1fe9e35a8fcb7cff4 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 09:56:26 -0800 Subject: [PATCH 072/206] Update manage-updates-baselines-microsoft-defender-antivirus.md pared down current version section --- ...-baselines-microsoft-defender-antivirus.md | 200 ------------------ 1 file changed, 200 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index e5bb66a2ff..369b94de5a 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -135,206 +135,6 @@ No known issues No known issues
    -
    - August-2020 (Platform: 4.18.2008.9 | Engine: 1.1.17400.5) - - Security intelligence update version: **1.323.9.0** - Released: **August 27, 2020** - Platform: **4.18.2008.9** - Engine: **1.1.17400.5** - Support phase: **Security and Critical Updates** - -### What's new - -- Add more telemetry events -- Improved scan event telemetry -- Improved behavior monitoring for memory scans -- Improved macro streams scanning -- Added `AMRunningMode` to Get-MpComputerStatus PowerShell cmdlet -- [DisableAntiSpyware](https://docs.microsoft.com/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware) is ignored. Microsoft Defender Antivirus automatically turns itself off when it detects another antivirus program. - - -### Known Issues -No known issues -
    -
    - -
    - July-2020 (Platform: 4.18.2007.8 | Engine: 1.1.17300.4) - - Security intelligence update version: **1.321.30.0** - Released: **July 28, 2020** - Platform: **4.18.2007.8** - Engine: **1.1.17300.4** - Support phase: **Security and Critical Updates** - -### What's new -* Improved telemetry for BITS -* Improved Authenticode code signing certificate validation - -### Known Issues -No known issues -
    -
    - -
    - June-2020 (Platform: 4.18.2006.10 | Engine: 1.1.17200.2) - - Security intelligence update version: **1.319.20.0** - Released: **June 22, 2020** - Platform: **4.18.2006.10** - Engine: **1.1.17200.2** - Support phase: **Technical upgrade Support (Only)** - -### What's new -* Possibility to specify the [location of the support logs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data) -* Skipping aggressive catchup scan in Passive mode. -* Allow Defender to update on metered connections -* Fixed performance tuning when caching is disabled -* Fixed registry query -* Fixed scantime randomization in ADMX - -### Known Issues -No known issues -
    -
    - -
    - May-2020 (Platform: 4.18.2005.4 | Engine: 1.1.17100.2) - - Security intelligence update version: **1.317.20.0** - Released: **May 26, 2020** - Platform: **4.18.2005.4** - Engine: **1.1.17100.2** - Support phase: **Technical upgrade Support (Only)** - -### What's new -* Improved logging for scan events -* Improved user mode crash handling. -* Added event tracing for Tamper protection -* Fixed AMSI Sample submission -* Fixed AMSI Cloud blocking -* Fixed Security update install log - -### Known Issues -No known issues -
    -
    - -
    - April-2020 (Platform: 4.18.2004.6 | Engine: 1.1.17000.2) - - Security intelligence update version: **1.315.12.0** - Released: **April 30, 2020** - Platform: **4.18.2004.6** - Engine: **1.1.17000.2** - Support phase: **Technical upgrade Support (Only)** - -### What's new -* WDfilter improvements -* Add more actionable event data to attack surface reduction detection events -* Fixed version information in diagnostic data and WMI -* Fixed incorrect platform version in UI after platform update -* Dynamic URL intel for Fileless threat protection -* UEFI scan capability -* Extend logging for updates - -### Known Issues -No known issues -
    -
    - -
    - March-2020 (Platform: 4.18.2003.8 | Engine: 1.1.16900.2) - - Security intelligence update version: **1.313.8.0** - Released: **March 24, 2020** - Platform: **4.18.2003.8** - Engine: **1.1.16900.4** - Support phase: **Technical upgrade Support (Only)** - -### What's new - -* CPU Throttling option added to [MpCmdRun](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus) -* Improve diagnostic capability -* reduce Security intelligence timeout (5 min) -* Extend AMSI engine internal log capability -* Improve notification for process blocking - -### Known Issues -[**Fixed**] Microsoft Defender Antivirus is skipping files when running a scan. - -
    -
    - -
    - - February-2020 (Platform: - | Engine: 1.1.16800.2) - - - Security intelligence update version: **1.311.4.0** - Released: **February 25, 2020** - Platform/Client: **-** - Engine: **1.1.16800.2** - Support phase: **N/A** - -### What's new - - -### Known Issues -No known issues -
    -
    - -
    - January-2020 (Platform: 4.18.2001.10 | Engine: 1.1.16700.2) - - -Security intelligence update version: **1.309.32.0** -Released: **January 30, 2020** -Platform/Client: **4.18.2001.10** -Engine: **1.1.16700.2** -Support phase: **Technical upgrade Support (Only)** - -### What's new - -* Fixed BSOD on WS2016 with Exchange -* Support platform updates when TMP is redirected to network path -* Platform and engine versions are added to [WDSI](https://www.microsoft.com/wdsi/defenderupdates) -* extend Emergency signature update to [passive mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility) -* Fix 4.18.1911.3 hang - -### Known Issues -[**Fixed**] devices utilizing [modern standby mode](https://docs.microsoft.com/windows-hardware/design/device-experiences/modern-standby) may experience a hang with the Windows Defender filter driver that results in a gap of protection. Affected machines appear to the customer as having not updated to the latest antimalware platform. -
    -> [!IMPORTANT] -> This updates is needed by RS1 devices running lower version of the platform to support SHA2.
    This update has reboot flag for systems that are experiencing the hang issue.
    the This update is re-released in April 2020 and will not be superseded by newer updates to keep future availability. -
    -> [!IMPORTANT] -> This update is categorized as an "update" due to its reboot requirement and will only be offered with a [Windows Update](https://support.microsoft.com/help/4027667/windows-10-update) -
    -
    - -
    - November-2019 (Platform: 4.18.1911.3 | Engine: 1.1.16600.7) - -Security intelligence update version: **1.307.13.0** -Released: **December 7, 2019** -Platform: **4.18.1911.3** -Engine: **1.1.17000.7** -Support phase: **No support** - -### What's new - -* Fixed MpCmdRun tracing level -* Fixed WDFilter version info -* Improve notifications (PUA) -* add MRT logs to support files - -### Known Issues -When this update is installed, the device needs the jump package 4.10.2001.10 to be able to update to the latest platform version. -
    -
    ### Previous version updates: Technical upgrade support only From 416714f3047acf819fdd17f7a1af61e609ccba4a Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 09:57:33 -0800 Subject: [PATCH 073/206] Update manage-updates-baselines-microsoft-defender-antivirus.md set the previous versions section right --- ...-baselines-microsoft-defender-antivirus.md | 58 ------------------- 1 file changed, 58 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index 369b94de5a..51619b0baa 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -141,64 +141,6 @@ No known issues
    -
    - November-2020 (Platform: 4.18.2011.6 | Engine: 1.1.17700.4) - - Security intelligence update version: **1.327.1854.0** - Released: **December 03, 2020** - Platform: **4.18.2011.6** - Engine: **1.1.17700.4** - Support phase: **Security and Critical Updates** - -### What's new -- Improved SmartScreen status support logging -- Apply CPU throttling policy to manually initiated scans - -### Known Issues -No known issues -
    -
    - October-2020 (Platform: 4.18.2010.7 | Engine: 1.1.17600.5) - - Security intelligence update version: **1.327.7.0** - Released: **October 29, 2020** - Platform: **4.18.2010.7** - Engine: **1.1.17600.5** - Support phase: **Security and Critical Updates** - -### What's new -- New descriptions for special threat categories -- Improved emulation capabilities -- Improved host address allow/block capabilities -- New option in Defender CSP to Ignore merging of local user exclusions - -### Known Issues -No known issues -
    -
    - September-2020 (Platform: 4.18.2009.7 | Engine: 1.1.17500.4) - - Security intelligence update version: **1.325.10.0** - Released: **October 01, 2020** - Platform: **4.18.2009.7** - Engine: **1.1.17500.4** - Support phase: **Security and Critical Updates** - -### What's new -- Admin permissions are required to restore files in quarantine -- XML formatted events are now supported -- CSP support for ignoring exclusion merges -- New management interfaces for: - - UDP Inspection - - Network Protection on Server 2019 - - IP Address exclusions for Network Protection -- Improved visibility into TPM measurements -- Improved Office VBA module scanning - -### Known Issues -No known issues -
    -
    August-2020 (Platform: 4.18.2008.9 | Engine: 1.1.17400.5) From 73a985f3c311e4c1d5ca49669d34a88560c1a6ed Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 10:04:11 -0800 Subject: [PATCH 074/206] Update manage-updates-baselines-microsoft-defender-antivirus.md --- .../manage-updates-baselines-microsoft-defender-antivirus.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index 51619b0baa..44ab2eeb3b 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -138,8 +138,7 @@ No known issues ### Previous version updates: Technical upgrade support only -
    - +Previous version updates are listed below, and are provided for technical upgrade support only.
    August-2020 (Platform: 4.18.2008.9 | Engine: 1.1.17400.5) From cc317b344eb1ab1b72f9447bee04657ef53ea525 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 10:06:27 -0800 Subject: [PATCH 075/206] Update manage-updates-baselines-microsoft-defender-antivirus.md --- ...s-baselines-microsoft-defender-antivirus.md | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index 44ab2eeb3b..fcdf912ecb 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -174,8 +174,9 @@ No known issues  Support phase: **Security and Critical Updates** ### What's new -* Improved telemetry for BITS -* Improved Authenticode code signing certificate validation + +- Improved telemetry for BITS +- Improved Authenticode code signing certificate validation ### Known Issues No known issues @@ -192,12 +193,13 @@ No known issues  Support phase: **Technical upgrade Support (Only)** ### What's new -* Possibility to specify the [location of the support logs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data) -* Skipping aggressive catchup scan in Passive mode. -* Allow Defender to update on metered connections -* Fixed performance tuning when caching is disabled -* Fixed registry query -* Fixed scantime randomization in ADMX + +- Possibility to specify the [location of the support logs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data) +- Skipping aggressive catchup scan in Passive mode. +- Allow Defender to update on metered connections +- Fixed performance tuning when caching is disabled +- Fixed registry query +- Fixed scantime randomization in ADMX ### Known Issues No known issues From b8b63496d4d95ade904771ceebe2963fa6b155b0 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 10:08:53 -0800 Subject: [PATCH 076/206] Update manage-updates-baselines-microsoft-defender-antivirus.md --- .../manage-updates-baselines-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index fcdf912ecb..e03dbc86af 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -138,7 +138,7 @@ No known issues ### Previous version updates: Technical upgrade support only -Previous version updates are listed below, and are provided for technical upgrade support only. +Previous version updates are listed below, and are provided for technical upgrade support only.
    August-2020 (Platform: 4.18.2008.9 | Engine: 1.1.17400.5) From 826a1a8811b502b5ea1919939cbd17e6d907a624 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 10:15:42 -0800 Subject: [PATCH 077/206] Update manage-updates-baselines-microsoft-defender-antivirus.md --- .../manage-updates-baselines-microsoft-defender-antivirus.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index e03dbc86af..1a71bfa5e6 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -68,7 +68,7 @@ For more information, see [Manage the sources for Microsoft Defender Antivirus p ## Monthly platform and engine versions -For information how to update or how to install the platform update, see [Update for Windows Defender antimalware platform](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform). +For information how to update or install the platform update, see [Update for Windows Defender antimalware platform](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform). All our updates contain - performance improvements; @@ -138,7 +138,8 @@ No known issues ### Previous version updates: Technical upgrade support only -Previous version updates are listed below, and are provided for technical upgrade support only.
    +Previous version updates are listed below, and are provided for technical upgrade support only. +
    August-2020 (Platform: 4.18.2008.9 | Engine: 1.1.17400.5) From fca8929adac3fdb1f6b1477f674cab953066fdab Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 10:20:10 -0800 Subject: [PATCH 078/206] Update manage-updates-baselines-microsoft-defender-antivirus.md --- ...-baselines-microsoft-defender-antivirus.md | 26 +++++++++---------- 1 file changed, 12 insertions(+), 14 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index 1a71bfa5e6..ced116a6ed 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -148,7 +148,6 @@ Previous version updates are listed below, and are provided for technical upgrad  Released: **August 27, 2020**  Platform: **4.18.2008.9**  Engine: **1.1.17400.5** - Support phase: **Security and Critical Updates** ### What's new @@ -172,7 +171,7 @@ No known issues  Released: **July 28, 2020**  Platform: **4.18.2007.8**  Engine: **1.1.17300.4** - Support phase: **Security and Critical Updates** + Support phase: **Technical upgrade support (only)** ### What's new @@ -191,7 +190,7 @@ No known issues  Released: **June 22, 2020**  Platform: **4.18.2006.10**  Engine: **1.1.17200.2** - Support phase: **Technical upgrade Support (Only)** + Support phase: **Technical upgrade support (only)** ### What's new @@ -214,7 +213,7 @@ No known issues  Released: **May 26, 2020**  Platform: **4.18.2005.4**  Engine: **1.1.17100.2** - Support phase: **Technical upgrade Support (Only)** + Support phase: **Technical upgrade support (only)** ### What's new * Improved logging for scan events @@ -236,7 +235,7 @@ No known issues  Released: **April 30, 2020**  Platform: **4.18.2004.6**  Engine: **1.1.17000.2** - Support phase: **Technical upgrade Support (Only)** + Support phase: **Technical upgrade support (only)** ### What's new * WDfilter improvements @@ -259,7 +258,7 @@ No known issues  Released: **March 24, 2020**  Platform: **4.18.2003.8**  Engine: **1.1.16900.4** - Support phase: **Technical upgrade Support (Only)** + Support phase: **Technical upgrade support (only)** ### What's new @@ -280,11 +279,11 @@ No known issues February-2020 (Platform: - | Engine: 1.1.16800.2) - Security intelligence update version: **1.311.4.0** - Released: **February 25, 2020** - Platform/Client: **-** - Engine: **1.1.16800.2** - Support phase: **N/A** + Security intelligence update version: **1.311.4.0** + Released: **February 25, 2020** + Platform/Client: **-** + Engine: **1.1.16800.2** + Support phase: **Technical upgrade support (only)** ### What's new @@ -302,7 +301,7 @@ Security intelligence update version: **1.309.32.0** Released: **January 30, 2020** Platform/Client: **4.18.2001.10** Engine: **1.1.16700.2** -Support phase: **Technical upgrade Support (Only)** + Support phase: **Technical upgrade support (only)** ### What's new @@ -317,8 +316,7 @@ Support phase: **Technical upgrade Support (Only)**
    > [!IMPORTANT] > This updates is needed by RS1 devices running lower version of the platform to support SHA2.
    This update has reboot flag for systems that are experiencing the hang issue.
    the This update is re-released in April 2020 and will not be superseded by newer updates to keep future availability. -
    -> [!IMPORTANT] +> > This update is categorized as an "update" due to its reboot requirement and will only be offered with a [Windows Update](https://support.microsoft.com/help/4027667/windows-10-update)
    From dc492ee3d0ce928a299c4a0cfa47a44dfa6a9ded Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 10:21:36 -0800 Subject: [PATCH 079/206] Update manage-updates-baselines-microsoft-defender-antivirus.md --- ...e-updates-baselines-microsoft-defender-antivirus.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index ced116a6ed..1a06c92c1c 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -305,11 +305,11 @@ Engine: **1.1.16700.2** ### What's new -* Fixed BSOD on WS2016 with Exchange -* Support platform updates when TMP is redirected to network path -* Platform and engine versions are added to [WDSI](https://www.microsoft.com/wdsi/defenderupdates) -* extend Emergency signature update to [passive mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility) -* Fix 4.18.1911.3 hang +- Fixed BSOD on WS2016 with Exchange +- Support platform updates when TMP is redirected to network path +- Platform and engine versions are added to [WDSI](https://www.microsoft.com/wdsi/defenderupdates) +- extend Emergency signature update to [passive mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility) +- Fix 4.18.1911.3 hang ### Known Issues [**Fixed**] devices utilizing [modern standby mode](https://docs.microsoft.com/windows-hardware/design/device-experiences/modern-standby) may experience a hang with the Windows Defender filter driver that results in a gap of protection. Affected machines appear to the customer as having not updated to the latest antimalware platform. From d96c503113c007458469f126bae0d898f3ed4b14 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 10:44:40 -0800 Subject: [PATCH 080/206] Update manage-updates-baselines-microsoft-defender-antivirus.md --- ...pdates-baselines-microsoft-defender-antivirus.md | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index 1a06c92c1c..5ad59164fb 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -47,7 +47,7 @@ Microsoft Defender Antivirus uses [cloud-delivered protection](utilize-microsoft Cloud-delivered protection is always on and requires an active connection to the Internet to function. Security intelligence updates occur on a scheduled cadence (configurable via policy). For more information, see [Use Microsoft cloud-provided protection in Microsoft Defender Antivirus](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md). -For a list of recent security intelligence updates, please visit: [Antimalware updates change log - Microsoft Security Intelligence](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes). +For a list of recent security intelligence updates, see [Antimalware updates change log - Microsoft Security Intelligence](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes). Engine updates are included with security intelligence updates and are released on a monthly cadence. @@ -315,9 +315,12 @@ Engine: **1.1.16700.2** [**Fixed**] devices utilizing [modern standby mode](https://docs.microsoft.com/windows-hardware/design/device-experiences/modern-standby) may experience a hang with the Windows Defender filter driver that results in a gap of protection. Affected machines appear to the customer as having not updated to the latest antimalware platform.
    > [!IMPORTANT] -> This updates is needed by RS1 devices running lower version of the platform to support SHA2.
    This update has reboot flag for systems that are experiencing the hang issue.
    the This update is re-released in April 2020 and will not be superseded by newer updates to keep future availability. -> -> This update is categorized as an "update" due to its reboot requirement and will only be offered with a [Windows Update](https://support.microsoft.com/help/4027667/windows-10-update) +> This update is: +> - needed by RS1 devices running lower version of the platform to support SHA2; +> - has a reboot flag for systems that have hanging issues; +> - is re-released in April 2020 and will not be superseded by newer updates to keep future availability; +> - is categorized as an update due to the reboot requirement; and +> - is only be offered with [Windows Update](https://support.microsoft.com/help/4027667/windows-10-update).
    @@ -439,7 +442,7 @@ We recommend updating your Windows 10 (Enterprise, Pro, and Home editions), Wind | Article | Description | |:---|:---| |[Microsoft Defender update for Windows operating system installation images](https://support.microsoft.com/help/4568292/defender-update-for-windows-operating-system-installation-images) | Review antimalware update packages for your OS installation images (WIM and VHD files). Get Microsoft Defender Antivirus updates for Windows 10 (Enterprise, Pro, and Home editions), Windows Server 2019, and Windows Server 2016 installation images. | -|[Manage how protection updates are downloaded and applied](manage-protection-updates-microsoft-defender-antivirus.md) | Protection updates can be delivered through a number of sources. | +|[Manage how protection updates are downloaded and applied](manage-protection-updates-microsoft-defender-antivirus.md) | Protection updates can be delivered through many sources. | |[Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) | You can schedule when protection updates should be downloaded. | |[Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) | If an endpoint misses an update or scheduled scan, you can force an update or scan the next time a user signs in. | |[Manage event-based forced updates](manage-event-based-updates-microsoft-defender-antivirus.md) | You can set protection updates to be downloaded at startup or after certain cloud-delivered protection events. | From 8dcc321629d71e40ba144d416f16a58282dd616d Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 10:53:25 -0800 Subject: [PATCH 081/206] Update manage-updates-baselines-microsoft-defender-antivirus.md --- .../manage-updates-baselines-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index 5ad59164fb..5f8677d0a2 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -74,7 +74,7 @@ All our updates contain - performance improvements; - serviceability improvements; and - integration improvements (Cloud, Microsoft 365 Defender). -
    +

    From a7c9d594764abfdcf662c3209e6f38b5de726d38 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 12:47:02 -0800 Subject: [PATCH 082/206] Update manage-updates-baselines-microsoft-defender-antivirus.md --- .../manage-updates-baselines-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index 5f8677d0a2..0eca49c841 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -139,7 +139,7 @@ No known issues ### Previous version updates: Technical upgrade support only Previous version updates are listed below, and are provided for technical upgrade support only. -
    +

    August-2020 (Platform: 4.18.2008.9 | Engine: 1.1.17400.5) From e09403ba403f4b2eef8e5ffc73e38487695d0fdd Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 12:49:31 -0800 Subject: [PATCH 083/206] Update manage-updates-baselines-microsoft-defender-antivirus.md --- ...-baselines-microsoft-defender-antivirus.md | 52 +++++++++---------- 1 file changed, 26 insertions(+), 26 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index 0eca49c841..8c2cf4a503 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -216,12 +216,13 @@ No known issues  Support phase: **Technical upgrade support (only)** ### What's new -* Improved logging for scan events -* Improved user mode crash handling. -* Added event tracing for Tamper protection -* Fixed AMSI Sample submission -* Fixed AMSI Cloud blocking -* Fixed Security update install log + +- Improved logging for scan events +- Improved user mode crash handling. +- Added event tracing for Tamper protection +- Fixed AMSI Sample submission +- Fixed AMSI Cloud blocking +- Fixed Security update install log ### Known Issues No known issues @@ -238,13 +239,13 @@ No known issues  Support phase: **Technical upgrade support (only)** ### What's new -* WDfilter improvements -* Add more actionable event data to attack surface reduction detection events -* Fixed version information in diagnostic data and WMI -* Fixed incorrect platform version in UI after platform update -* Dynamic URL intel for Fileless threat protection -* UEFI scan capability -* Extend logging for updates +- WDfilter improvements +- Add more actionable event data to attack surface reduction detection events +- Fixed version information in diagnostic data and WMI +- Fixed incorrect platform version in UI after platform update +- Dynamic URL intel for Fileless threat protection +- UEFI scan capability +- Extend logging for updates ### Known Issues No known issues @@ -262,11 +263,11 @@ No known issues ### What's new -* CPU Throttling option added to [MpCmdRun](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus) -* Improve diagnostic capability -* reduce Security intelligence timeout (5 min) -* Extend AMSI engine internal log capability -* Improve notification for process blocking +- CPU Throttling option added to [MpCmdRun](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus) +- Improve diagnostic capability +- reduce Security intelligence timeout (5 min) +- Extend AMSI engine internal log capability +- Improve notification for process blocking ### Known Issues [**Fixed**] Microsoft Defender Antivirus is skipping files when running a scan. @@ -335,10 +336,10 @@ Support phase: **No support** ### What's new -* Fixed MpCmdRun tracing level -* Fixed WDFilter version info -* Improve notifications (PUA) -* add MRT logs to support files +- Fixed MpCmdRun tracing level +- Fixed WDFilter version info +- Improve notifications (PUA) +- add MRT logs to support files ### Known Issues When this update is installed, the device needs the jump package 4.10.2001.10 to be able to update to the latest platform version. @@ -350,10 +351,9 @@ When this update is installed, the device needs the jump package 4.10.2001.10 to Platform and engine updates are provided on a monthly cadence. To be fully supported, keep current with the latest platform updates. Our support structure is dynamic, evolving into two phases depending on the availability of the latest platform version: -* **Security and Critical Updates servicing phase** - When running the latest platform version, you will be eligible to receive both Security and Critical updates to the anti-malware platform. +- **Security and Critical Updates servicing phase** - When running the latest platform version, you will be eligible to receive both Security and Critical updates to the anti-malware platform. - -* **Technical Support (Only) phase** - After a new platform version is released, support for older versions (N-2) will reduce to technical support only. Platform versions older than N-2 will no longer be supported.* +- **Technical Support (Only) phase** - After a new platform version is released, support for older versions (N-2) will reduce to technical support only. Platform versions older than N-2 will no longer be supported.* \* Technical support will continue to be provided for upgrades from the Windows 10 release version (see [Platform version included with Windows 10 releases](#platform-version-included-with-windows-10-releases)) to the latest platform version. @@ -437,7 +437,7 @@ We recommend updating your Windows 10 (Enterprise, Pro, and Home editions), Wind
    -## See also +## Additional resources | Article | Description | |:---|:---| From e70b00fdb317a77d4af5e179e4a46a255763c772 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 12:51:23 -0800 Subject: [PATCH 084/206] Update manage-updates-baselines-microsoft-defender-antivirus.md --- .../manage-updates-baselines-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index 8c2cf4a503..ab98ec1db1 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -13,7 +13,7 @@ ms.author: deniseb ms.custom: nextgen ms.reviewer: manager: dansimp -ms.date: 12/05/2020 +ms.date: 01/06/2021 --- # Manage Microsoft Defender Antivirus updates and apply baselines From 3d534fd878ebe46062e47359c39ad3adc08c1334 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 12:52:38 -0800 Subject: [PATCH 085/206] Update manage-updates-baselines-microsoft-defender-antivirus.md --- .../manage-updates-baselines-microsoft-defender-antivirus.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index ab98ec1db1..05f8205f31 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -377,7 +377,9 @@ Windows 10 release info: [Windows lifecycle fact sheet](https://support.microsof ## Updates for Deployment Image Servicing and Management (DISM) -We recommend updating your Windows 10 (Enterprise, Pro, and Home editions), Windows Server 2019, and Windows Server 2016 OS installation images with the latest antivirus and antimalware updates. Keeping your OS installation images up to date helps avoid a gap in protection. For more information, see [Microsoft Defender update for Windows operating system installation images](https://support.microsoft.com/help/4568292/defender-update-for-windows-operating-system-installation-images). +We recommend updating your Windows 10 (Enterprise, Pro, and Home editions), Windows Server 2019, and Windows Server 2016 OS installation images with the latest antivirus and antimalware updates. Keeping your OS installation images up to date helps avoid a gap in protection. + +For more information, see [Microsoft Defender update for Windows operating system installation images](https://support.microsoft.com/help/4568292/defender-update-for-windows-operating-system-installation-images).
    1.1.2012.01 From 626b657efce0437d1b286550b1a9d53c40f6f678 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 12:56:43 -0800 Subject: [PATCH 086/206] Update manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md --- ...updates-mobile-devices-vms-microsoft-defender-antivirus.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md index fbbf677933..dd49d3b0d9 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md @@ -1,6 +1,6 @@ --- -title: Define how mobile devices are updated by Microsoft Defender AV -description: Manage how mobile devices, such as laptops, should be updated with Microsoft Defender AV protection updates. +title: Define how mobile devices are updated by Microsoft Defender Antivirus +description: Manage how mobile devices, such as laptops, should be updated with Microsoft Defender Antivirus protection updates. keywords: updates, protection, schedule updates, battery, mobile device, laptop, notebook, opt-in, microsoft update, wsus, override search.product: eADQiWindows 10XVcnh ms.prod: w10 From f0bac1eec4ef42ca874ba877510e85e8ef7f63b9 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 12:56:56 -0800 Subject: [PATCH 087/206] added ms.reviewer --- ...e-protection-update-schedule-microsoft-defender-antivirus.md | 2 +- .../manage-protection-updates-microsoft-defender-antivirus.md | 2 +- .../manage-updates-baselines-microsoft-defender-antivirus.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus.md index add2af0433..acbc359a64 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus.md @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: denisebmsft ms.author: deniseb ms.custom: nextgen -ms.reviewer: +ms.reviewer: pahuijbr manager: dansimp --- diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md index 7dcee83d5a..9cfcd64a5d 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.localizationpriority: medium author: denisebmsft ms.author: deniseb -ms.reviewer: +ms.reviewer: pahuijbr manager: dansimp ms.custom: nextgen --- diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index 05f8205f31..943036f62c 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -11,7 +11,7 @@ ms.localizationpriority: medium author: denisebmsft ms.author: deniseb ms.custom: nextgen -ms.reviewer: +ms.reviewer: pahuijbr manager: dansimp ms.date: 01/06/2021 --- From f11d7c5bb46be69cdab41a8e9041a45dcd272e46 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 13:04:22 -0800 Subject: [PATCH 088/206] Update manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md --- ...es-mobile-devices-vms-microsoft-defender-antivirus.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md index dd49d3b0d9..788464ca9c 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md @@ -11,7 +11,6 @@ ms.localizationpriority: medium author: denisebmsft ms.author: deniseb ms.custom: nextgen -ms.date: 09/03/2018 ms.reviewer: manager: dansimp --- @@ -25,14 +24,14 @@ manager: dansimp - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) -Mobile devices and VMs may require additional configuration to ensure performance is not impacted by updates. +Mobile devices and VMs may require more configuration to ensure performance is not impacted by updates. -There are two settings that are particularly useful for these devices: +There are two settings that are useful for these devices: -- Opt-in to Microsoft Update on mobile computers without a WSUS connection +- Opt in to Microsoft Update on mobile computers without a WSUS connection - Prevent Security intelligence updates when running on battery power -The following topics may also be useful in these situations: +The following articles may also be useful in these situations: - [Configuring scheduled and catch-up scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) - [Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) - [Deployment guide for Microsoft Defender Antivirus in a virtual desktop infrastructure (VDI) environment](deployment-vdi-microsoft-defender-antivirus.md) From c3db2e4504e7aef50e2875f930c91906f16fbd3c Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 13:05:03 -0800 Subject: [PATCH 089/206] Update manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md --- ...-mobile-devices-vms-microsoft-defender-antivirus.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md index 788464ca9c..d4f2648721 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md @@ -36,21 +36,21 @@ The following articles may also be useful in these situations: - [Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) - [Deployment guide for Microsoft Defender Antivirus in a virtual desktop infrastructure (VDI) environment](deployment-vdi-microsoft-defender-antivirus.md) -## Opt-in to Microsoft Update on mobile computers without a WSUS connection +## Opt in to Microsoft Update on mobile computers without a WSUS connection You can use Microsoft Update to keep Security intelligence on mobile devices running Microsoft Defender Antivirus up to date when they are not connected to the corporate network or don't otherwise have a WSUS connection. This means that protection updates can be delivered to devices (via Microsoft Update) even if you have set WSUS to override Microsoft Update. -You can opt-in to Microsoft Update on the mobile device in one of the following ways: +You can opt in to Microsoft Update on the mobile device in one of the following ways: 1. Change the setting with Group Policy 2. Use a VBScript to create a script, then run it on each computer in your network. -3. Manually opt-in every computer on your network through the **Settings** menu. +3. Manually opt in every computer on your network through the **Settings** menu. -### Use Group Policy to opt-in to Microsoft Update +### Use Group Policy to opt in to Microsoft Update -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and select **Edit**. 3. In the **Group Policy Management Editor** go to **Computer configuration**. From fc6aa4c6fbc44a975595272f6b3b6f2d8a54b7a8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 13:06:10 -0800 Subject: [PATCH 090/206] Update manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md --- ...e-devices-vms-microsoft-defender-antivirus.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md index d4f2648721..0aebecaa24 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md @@ -44,21 +44,21 @@ This means that protection updates can be delivered to devices (via Microsoft Up You can opt in to Microsoft Update on the mobile device in one of the following ways: -1. Change the setting with Group Policy -2. Use a VBScript to create a script, then run it on each computer in your network. -3. Manually opt in every computer on your network through the **Settings** menu. +- Change the setting with Group Policy. +- Use a VBScript to create a script, then run it on each computer in your network. +- Manually opt in every computer on your network through the **Settings** menu. ### Use Group Policy to opt in to Microsoft Update -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and select **Edit**. +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and select **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration**. +2. In the **Group Policy Management Editor** go to **Computer configuration**. -4. Click **Policies** then **Administrative templates**. +3. Click **Policies** then **Administrative templates**. -5. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Signature Updates**. +4. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Signature Updates**. -6. Double-click the **Allow security intelligence updates from Microsoft Update** setting and set the option to **Enabled**. Click **OK**. +5. Double-click the **Allow security intelligence updates from Microsoft Update** setting and set the option to **Enabled**. Click **OK**. ### Use a VBScript to opt-in to Microsoft Update From 46347c664d31c280299be5b2b46bcb6fe27722b8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 13:07:11 -0800 Subject: [PATCH 091/206] Update manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md --- ...evices-vms-microsoft-defender-antivirus.md | 24 ++++++++++--------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md index 0aebecaa24..e9c2d12071 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md @@ -63,14 +63,17 @@ You can opt in to Microsoft Update on the mobile device in one of the following ### Use a VBScript to opt-in to Microsoft Update -1. Use the instructions in the MSDN article [Opt-In to Microsoft Update](https://msdn.microsoft.com/library/windows/desktop/aa826676.aspx) to create the VBScript. -2. Run the VBScript you created on each computer in your network. +1. Use the instructions in the MSDN article [Opt-In to Microsoft Update](https://msdn.microsoft.com/library/windows/desktop/aa826676.aspx) to create the VBScript. + +2. Run the VBScript you created on each computer in your network. ### Manually opt-in to Microsoft Update -1. Open **Windows Update** in **Update & security** settings on the computer you want to opt-in. -2. Click **Advanced** options. -3. Select the checkbox for **Give me updates for other Microsoft products when I update Windows**. +1. Open **Windows Update** in **Update & security** settings on the computer you want to opt-in. + +2. Click **Advanced** options. + +3. Select the checkbox for **Give me updates for other Microsoft products when I update Windows**. ## Prevent Security intelligence updates when running on battery power @@ -80,15 +83,14 @@ You can configure Microsoft Defender Antivirus to only download protection updat 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration**. +2. In the **Group Policy Management Editor** go to **Computer configuration**. -4. Click **Policies** then **Administrative templates**. +3. Click **Policies** then **Administrative templates**. -5. Expand the tree to **Windows components > Microsoft Defender Antivirus > Signature Updates** and configure the following setting: - - 1. Double-click the **Allow security intelligence updates when running on battery power** setting and set the option to **Disabled**. - 2. Click **OK**. This will prevent protection updates from downloading when the PC is on battery power. +4. Expand the tree to **Windows components > Microsoft Defender Antivirus > Signature Updates** and configure the following setting: + - Double-click the **Allow security intelligence updates when running on battery power** setting and set the option to **Disabled**. + - Click **OK**. This will prevent protection updates from downloading when the PC is on battery power. ## Related articles From ba0e74fc8109ec3be756de9b64ce3e118ee8f255 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 13:09:57 -0800 Subject: [PATCH 092/206] Update manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md --- ...-devices-vms-microsoft-defender-antivirus.md | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md index e9c2d12071..816025ec14 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md @@ -54,24 +54,24 @@ You can opt in to Microsoft Update on the mobile device in one of the following 2. In the **Group Policy Management Editor** go to **Computer configuration**. -3. Click **Policies** then **Administrative templates**. +3. Select **Policies** then **Administrative templates**. 4. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Signature Updates**. -5. Double-click the **Allow security intelligence updates from Microsoft Update** setting and set the option to **Enabled**. Click **OK**. +5. Set **Allow security intelligence updates from Microsoft Update** to **Enabled**, and then select **OK**. -### Use a VBScript to opt-in to Microsoft Update +### Use a VBScript to opt in to Microsoft Update 1. Use the instructions in the MSDN article [Opt-In to Microsoft Update](https://msdn.microsoft.com/library/windows/desktop/aa826676.aspx) to create the VBScript. 2. Run the VBScript you created on each computer in your network. -### Manually opt-in to Microsoft Update +### Manually opt in to Microsoft Update -1. Open **Windows Update** in **Update & security** settings on the computer you want to opt-in. +1. Open **Windows Update** in **Update & security** settings on the computer you want to opt in. -2. Click **Advanced** options. +2. Select **Advanced** options. 3. Select the checkbox for **Give me updates for other Microsoft products when I update Windows**. @@ -87,10 +87,9 @@ You can configure Microsoft Defender Antivirus to only download protection updat 3. Click **Policies** then **Administrative templates**. -4. Expand the tree to **Windows components > Microsoft Defender Antivirus > Signature Updates** and configure the following setting: +4. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Signature Updates**, and then set **Allow security intelligence updates when running on battery power** to **Disabled**. Then select **OK**. - - Double-click the **Allow security intelligence updates when running on battery power** setting and set the option to **Disabled**. - - Click **OK**. This will prevent protection updates from downloading when the PC is on battery power. +This action prevents protection updates from downloading when the PC is on battery power. ## Related articles From 8780dfa7a688808075a706f2327abc00fb41acdd Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 13:11:02 -0800 Subject: [PATCH 093/206] acrolinx fixes --- .../manage-updates-baselines-microsoft-defender-antivirus.md | 5 +++++ ...pdates-mobile-devices-vms-microsoft-defender-antivirus.md | 4 ++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index 943036f62c..4f60e5d308 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -87,6 +87,7 @@ All our updates contain  Support phase: **Security and Critical Updates** ### What's new + - Improved SmartScreen status support logging - Apply CPU throttling policy to manually initiated scans @@ -103,12 +104,14 @@ No known issues  Support phase: **Security and Critical Updates** ### What's new + - New descriptions for special threat categories - Improved emulation capabilities - Improved host address allow/block capabilities - New option in Defender CSP to Ignore merging of local user exclusions ### Known Issues + No known issues
    @@ -121,6 +124,7 @@ No known issues  Support phase: **Security and Critical Updates** ### What's new + - Admin permissions are required to restore files in quarantine - XML formatted events are now supported - CSP support for ignoring exclusion merges @@ -132,6 +136,7 @@ No known issues - Improved Office VBA module scanning ### Known Issues + No known issues
    diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md index 816025ec14..e2fb5173d8 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md @@ -81,11 +81,11 @@ You can configure Microsoft Defender Antivirus to only download protection updat ### Use Group Policy to prevent security intelligence updates on battery power -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), choose the Group Policy Object you want to configure, and open it for editing. 2. In the **Group Policy Management Editor** go to **Computer configuration**. -3. Click **Policies** then **Administrative templates**. +3. Select **Policies** then **Administrative templates**. 4. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Signature Updates**, and then set **Allow security intelligence updates when running on battery power** to **Disabled**. Then select **OK**. From fe649b4c7c31cb96b839b1239afa9629c24a3c37 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 6 Jan 2021 13:48:15 -0800 Subject: [PATCH 094/206] Removed "en-us" from a Microsoft URL (and verified that it works) --- .../manage-updates-baselines-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index 4f60e5d308..7835dd3bfa 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -47,7 +47,7 @@ Microsoft Defender Antivirus uses [cloud-delivered protection](utilize-microsoft Cloud-delivered protection is always on and requires an active connection to the Internet to function. Security intelligence updates occur on a scheduled cadence (configurable via policy). For more information, see [Use Microsoft cloud-provided protection in Microsoft Defender Antivirus](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md). -For a list of recent security intelligence updates, see [Antimalware updates change log - Microsoft Security Intelligence](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes). +For a list of recent security intelligence updates, see [Antimalware updates change log - Microsoft Security Intelligence](https://www.microsoft.com/wdsi/definitions/antimalware-definition-release-notes). Engine updates are included with security intelligence updates and are released on a monthly cadence. From 42cd42a769e77b375de26bac0b2d699e431202ea Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 6 Jan 2021 13:52:15 -0800 Subject: [PATCH 095/206] Acrolinx: "Powershell" --- .../manage-protection-updates-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md index 9cfcd64a5d..42af3da160 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md @@ -170,7 +170,7 @@ Set up a network file share (UNC/mapped drive) to download security intelligence MD C:\Temp\TempSigs\x86 ``` -3. Download the Powershell script from [www.powershellgallery.com/packages/SignatureDownloadCustomTask/1.4](https://www.powershellgallery.com/packages/SignatureDownloadCustomTask/1.4). +3. Download the PowerShell script from [www.powershellgallery.com/packages/SignatureDownloadCustomTask/1.4](https://www.powershellgallery.com/packages/SignatureDownloadCustomTask/1.4). 4. Click **Manual Download**. From e8871be545839500d584cf5fee416289e1db85ae Mon Sep 17 00:00:00 2001 From: adirdidi <68847945+adirdidi@users.noreply.github.com> Date: Thu, 7 Jan 2021 00:53:32 +0200 Subject: [PATCH 096/206] Update gov.md Updating GCC-H items. --- .../microsoft-defender-atp/gov.md | 40 +++++++++---------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/gov.md b/windows/security/threat-protection/microsoft-defender-atp/gov.md index 71d6de5b4d..115eb14cc6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/gov.md +++ b/windows/security/threat-protection/microsoft-defender-atp/gov.md @@ -49,13 +49,13 @@ Windows 10, version 1803 | ![No](../images/svg/check-no.svg) Coming soon | ![Yes Windows 10, version 1709 | ![No](../images/svg/check-no.svg)
    Note: Will not be supported | ![Yes](../images/svg/check-yes.svg) With [KB4499147](https://support.microsoft.com/help/4499147)
    Note: Will be deprecated, please upgrade Windows 10, version 1703 and earlier | ![No](../images/svg/check-no.svg)
    Note: Will not be supported | ![No](../images/svg/check-no.svg)
    Note: Will not be supported Windows Server 2019 (with [KB4586839](https://support.microsoft.com/help/4586839)) | ![Yes](../images/svg/check-yes.svg) | ![Yes](../images/svg/check-yes.svg) -Windows Server 2016 | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) -Windows Server 2012 R2 | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) -Windows Server 2008 R2 SP1 | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) -Windows 8.1 Enterprise | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) -Windows 8 Pro | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) -Windows 7 SP1 Enterprise | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) -Windows 7 SP1 Pro | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) +Windows Server 2016 | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development +Windows Server 2012 R2 | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development +Windows Server 2008 R2 SP1 | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development +Windows 8.1 Enterprise | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development +Windows 8 Pro | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development +Windows 7 SP1 Enterprise | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development +Windows 7 SP1 Pro | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development Mac OS | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) Linux | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) iOS | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) @@ -106,24 +106,24 @@ These are the known gaps as of January 2021: Feature name | GCC | GCC High :---|:---|:--- -Threat analytics | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) -Threat & vulnerability management | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) +Threat analytics | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development +Threat & vulnerability management | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development Automated investigation and remediation: Response to Office 365 alerts | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) -Automated investigation and remediation: Live response | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) -Management and APIs: Threat protection report | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) -Management and APIs: Device health and compliance report | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) -Management and APIs: Streaming API | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) -Management and APIs: Integration with third-party products | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) -Email notifications | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) -Evaluation lab | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) -Web content filtering | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) -Integrations: Azure Sentinel | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) +Automated investigation and remediation: Live response | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development +Management and APIs: Threat protection report | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development +Management and APIs: Device health and compliance report | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development +Management and APIs: Streaming API | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development +Management and APIs: Integration with third-party products | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development +Email notifications | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development +Evaluation lab | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development +Web content filtering | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development +Integrations: Azure Sentinel | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development Integrations: Microsoft Cloud App Security | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) Integrations: Microsoft Compliance Center | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) Integrations: Microsoft Defender for Identity | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) Integrations: Microsoft Defender for Office 365 | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) Integrations: Microsoft Endpoint DLP | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) Integrations: Microsoft Intune | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) -Integrations: Microsoft Power Automate & Azure Logic Apps | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) -Integrations: Skype for Business / Teams | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) +Integrations: Microsoft Power Automate & Azure Logic Apps | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development +Integrations: Skype for Business / Teams | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development Microsoft Threat Experts | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) From 7be16fb46bf696a82e35d4f6f6adf57f65a07190 Mon Sep 17 00:00:00 2001 From: adirdidi <68847945+adirdidi@users.noreply.github.com> Date: Thu, 7 Jan 2021 00:57:28 +0200 Subject: [PATCH 097/206] Update gov.md --- .../security/threat-protection/microsoft-defender-atp/gov.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/gov.md b/windows/security/threat-protection/microsoft-defender-atp/gov.md index 115eb14cc6..84f767e39e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/gov.md +++ b/windows/security/threat-protection/microsoft-defender-atp/gov.md @@ -123,7 +123,7 @@ Integrations: Microsoft Compliance Center | ![No](../images/svg/check-no.svg) | Integrations: Microsoft Defender for Identity | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) Integrations: Microsoft Defender for Office 365 | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) Integrations: Microsoft Endpoint DLP | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) -Integrations: Microsoft Intune | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) +Integrations: Microsoft Intune | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development Integrations: Microsoft Power Automate & Azure Logic Apps | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development Integrations: Skype for Business / Teams | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development Microsoft Threat Experts | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) From e45c64a19d9b466f61c5d51741343251be314cd1 Mon Sep 17 00:00:00 2001 From: adirdidi <68847945+adirdidi@users.noreply.github.com> Date: Thu, 7 Jan 2021 01:09:45 +0200 Subject: [PATCH 098/206] Update gov.md --- .../microsoft-defender-atp/gov.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/gov.md b/windows/security/threat-protection/microsoft-defender-atp/gov.md index 84f767e39e..3d962dd0a1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/gov.md +++ b/windows/security/threat-protection/microsoft-defender-atp/gov.md @@ -106,16 +106,16 @@ These are the known gaps as of January 2021: Feature name | GCC | GCC High :---|:---|:--- -Threat analytics | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development -Threat & vulnerability management | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development -Automated investigation and remediation: Response to Office 365 alerts | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) Automated investigation and remediation: Live response | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development -Management and APIs: Threat protection report | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development -Management and APIs: Device health and compliance report | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development -Management and APIs: Streaming API | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development -Management and APIs: Integration with third-party products | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development +Automated investigation and remediation: Response to Office 365 alerts | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) Email notifications | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development Evaluation lab | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development +Management and APIs: Device health and compliance report | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development +Management and APIs: Integration with third-party products | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development +Management and APIs: Streaming API | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development +Management and APIs: Threat protection report | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development +Threat & vulnerability management | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development +Threat analytics | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development Web content filtering | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development Integrations: Azure Sentinel | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development Integrations: Microsoft Cloud App Security | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) From 4e3f511b6407affadd31bfdf5ee41438c05f9bad Mon Sep 17 00:00:00 2001 From: adirdidi <68847945+adirdidi@users.noreply.github.com> Date: Thu, 7 Jan 2021 03:47:56 +0200 Subject: [PATCH 099/206] Update gov.md --- .../threat-protection/microsoft-defender-atp/gov.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/gov.md b/windows/security/threat-protection/microsoft-defender-atp/gov.md index 3d962dd0a1..b4e6a21755 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/gov.md +++ b/windows/security/threat-protection/microsoft-defender-atp/gov.md @@ -56,8 +56,8 @@ Windows 8.1 Enterprise | ![No](../images/svg/check-no.svg) Coming soon | ![No](. Windows 8 Pro | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development Windows 7 SP1 Enterprise | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development Windows 7 SP1 Pro | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development -Mac OS | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) -Linux | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) +Mac OS | ![No](../images/svg/check-no.svg) In development | ![No](../images/svg/check-no.svg) In development +Linux | ![No](../images/svg/check-no.svg) In development | ![No](../images/svg/check-no.svg) In development iOS | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) Android | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) @@ -116,7 +116,7 @@ Management and APIs: Streaming API | ![No](../images/svg/check-no.svg) Coming so Management and APIs: Threat protection report | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development Threat & vulnerability management | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development Threat analytics | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development -Web content filtering | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development +Web content filtering | ![No](../images/svg/check-no.svg) In development | ![No](../images/svg/check-no.svg) In development Integrations: Azure Sentinel | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development Integrations: Microsoft Cloud App Security | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) Integrations: Microsoft Compliance Center | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) From 57756ccc29977a9c507ee80efac23862981764a6 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 17:56:22 -0800 Subject: [PATCH 100/206] Update manage-updates-baselines-microsoft-defender-antivirus.md --- ...-baselines-microsoft-defender-antivirus.md | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index 7835dd3bfa..1b9cc2aad0 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -64,7 +64,7 @@ You can manage the distribution of updates through one of the following methods: For more information, see [Manage the sources for Microsoft Defender Antivirus protection updates](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus). > [!NOTE] -> We release these monthly updates in phases. This results in multiple packages visible in your WSUS server. +> Monthly updates are released in phases, resulting in multiple packages visible in your [Window Server Update Services](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). ## Monthly platform and engine versions @@ -143,7 +143,7 @@ No known issues ### Previous version updates: Technical upgrade support only -Previous version updates are listed below, and are provided for technical upgrade support only. +After a new package version is released, support for the previous two versions is reduced to technical support only. Versions older than that are listed in this section, and are provided for technical upgrade support only.

    @@ -369,16 +369,16 @@ The below table provides the Microsoft Defender Antivirus platform and engine ve |Windows 10 release |Platform version |Engine version |Support phase | |:---|:---|:---|:---| -|2004 (20H1) |4.18.2004.6 |1.1.17000.2 | Technical upgrade Support (Only) | -|1909 (19H2) |4.18.1902.5 |1.1.16700.3 | Technical upgrade Support (Only) | -|1903 (19H1) |4.18.1902.5 |1.1.15600.4 | Technical upgrade Support (Only) | -|1809 (RS5) |4.18.1807.18075 |1.1.15000.2 | Technical upgrade Support (Only) | -|1803 (RS4) |4.13.17134.1 |1.1.14600.4 | Technical upgrade Support (Only) | -|1709 (RS3) |4.12.16299.15 |1.1.14104.0 | Technical upgrade Support (Only) | -|1703 (RS2) |4.11.15603.2 |1.1.13504.0 | Technical upgrade Support (Only) | -|1607 (RS1) |4.10.14393.3683 |1.1.12805.0 | Technical upgrade Support (Only) | +|2004 (20H1) |4.18.2004.6 |1.1.17000.2 | Technical upgrade support (only) | +|1909 (19H2) |4.18.1902.5 |1.1.16700.3 | Technical upgrade support (only) | +|1903 (19H1) |4.18.1902.5 |1.1.15600.4 | Technical upgrade support (only) | +|1809 (RS5) |4.18.1807.18075 |1.1.15000.2 | Technical upgrade support (only) | +|1803 (RS4) |4.13.17134.1 |1.1.14600.4 | Technical upgrade support (only) | +|1709 (RS3) |4.12.16299.15 |1.1.14104.0 | Technical upgrade support (only) | +|1703 (RS2) |4.11.15603.2 |1.1.13504.0 | Technical upgrade support (only) | +|1607 (RS1) |4.10.14393.3683 |1.1.12805.0 | Technical upgrade support (only) | -Windows 10 release info: [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet). +For Windows 10 release information, see the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet). ## Updates for Deployment Image Servicing and Management (DISM) From 0644be036d2aa5048fa318d3975c1c15da9d0a5a Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 18:04:16 -0800 Subject: [PATCH 101/206] Update introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md --- ...-and-windows-defender-application-control.md | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md b/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md index f60748b37b..9483ca4022 100644 --- a/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md +++ b/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md @@ -1,13 +1,12 @@ --- -title: WDAC and virtualization-based code integrity (Windows 10) -description: Hardware and software system integrity-hardening capabilites that can be deployed separately or in combination with Windows Defender Application Control (WDAC). +title: Windows Defender Application Control and virtualization-based code integrity (Windows 10) +description: Hardware and software system integrity-hardening capabilities that can be deployed separately or in combination with Windows Defender Application Control (WDAC). keywords: virtualization, security, malware, device guard ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium author: denisebmsft ms.author: deniseb -ms.date: 07/01/2019 ms.reviewer: manager: dansimp ms.custom: asr @@ -19,24 +18,24 @@ ms.custom: asr - Windows 10 - Windows Server 2016 -Windows 10 includes a set of hardware and OS technologies that, when configured together, allow enterprises to "lock down" Windows 10 systems so they operate with many of the properties of mobile devices. In this configuration, specific technologies work together to restrict devices to only run authorized apps by using a feature called configurable code integrity, while simultaneously hardening the OS against kernel memory attacks through the use of virtualization-based protection of code integrity (more specifically, HVCI). +Windows 10 includes a set of hardware and OS technologies that, when configured together, allow enterprises to "lock down" Windows 10 systems so they operate with many of the properties of mobile devices. In this configuration, specific technologies work together to restrict devices to only run authorized apps by using a feature called configurable code integrity, while simultaneously hardening the OS against kernel memory attacks by using virtualization-based protection of code integrity (more specifically, HVCI). -Configurable code integrity policies and HVCI are very powerful protections that can be used separately. However, when these two technologies are configured to work together, they present a very strong protection capability for Windows 10 devices. +Configurable code integrity policies and HVCI are powerful protections that can be used separately. However, when these two technologies are configured to work together, they present a strong protection capability for Windows 10 devices. Using configurable code integrity to restrict devices to only authorized apps has these advantages over other solutions: 1. Configurable code integrity policy is enforced by the Windows kernel itself. As such, the policy takes effect early in the boot sequence before nearly all other OS code and before traditional antivirus solutions run. 2. Configurable code integrity allows customers to set application control policy not only over code running in user mode, but also kernel mode hardware and software drivers and even code that runs as part of Windows. -3. Customers can protect the configurable code integrity policy even from local administrator tampering by digitally signing the policy. This would mean that changing the policy would require both administrative privilege and access to the organization’s digital signing process, making it extremely difficult for an attacker with administrative privilege, or malicious software that managed to gain administrative privilege, to alter the application control policy. -4. The entire configurable code integrity enforcement mechanism can be protected by HVCI, where even if a vulnerability exists in kernel mode code, the likelihood that an attacker could successfully exploit it is significantly diminished. Why is this relevant? That’s because an attacker that compromises the kernel would otherwise have enough privilege to disable most system defenses and override the application control policies enforced by configurable code integrity or any other application control solution. +3. Customers can protect the configurable code integrity policy even from local administrator tampering by digitally signing the policy. This would mean that changing the policy would require both administrative privilege and access to the organization’s digital signing process, making it difficult for an attacker with administrative privilege, or malicious software that managed to gain administrative privilege, to alter the application control policy. +4. The entire configurable code integrity enforcement mechanism can be protected by HVCI, where even if a vulnerability exists in kernel mode code, the likelihood that an attacker could successfully exploit it is diminished. Why is this relevant? That’s because an attacker that compromises the kernel would otherwise have enough privilege to disable most system defenses and override the application control policies enforced by configurable code integrity or any other application control solution. ## Windows Defender Application Control -When we originally designed this configuration state, we did so with a specific security promise in mind. Although there were no direct dependencies between configurable code integrity and HVCI, we intentionally focused our discussion around the lockdown state you achieve when deploying them together. However, given that HVCI relies on Windows virtualization-based security, it comes with additional hardware, firmware, and kernel driver compatibility requirements that some older systems can’t meet. As a result, many IT Professionals assumed that because some systems couldn't use HVCI, they couldn’t use configurable code integrity either. +When we originally designed this configuration state, we did so with a specific security promise in mind. Although there were no direct dependencies between configurable code integrity and HVCI, we intentionally focused our discussion around the lockdown state you achieve when deploying them together. However, given that HVCI relies on Windows virtualization-based security, it comes with more hardware, firmware, and kernel driver compatibility requirements that some older systems can’t meet. As a result, many IT Professionals assumed that because some systems couldn't use HVCI, they couldn’t use configurable code integrity either. Configurable code integrity carries no specific hardware or software requirements other than running Windows 10, which means many IT professionals were wrongly denied the benefits of this powerful application control capability. -Since the initial release of Windows 10, the world has witnessed numerous hacking and malware attacks where application control alone could have prevented the attack altogether. With this in mind, we are discussing and documenting configurable code integrity as a independent technology within our security stack and giving it a name of its own: [Windows Defender Application Control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control). +Since the initial release of Windows 10, the world has witnessed numerous hacking and malware attacks where application control alone could have prevented the attack altogether. With this in mind, we are discussing and documenting configurable code integrity as an independent technology within our security stack and giving it a name of its own: [Windows Defender Application Control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control). We hope this change will help us better communicate options for adopting application control within an organization. ## Related articles From 0033e3f269e1d40daebd3fc293dd1a039f3c4462 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 18:07:50 -0800 Subject: [PATCH 102/206] Update network-protection.md --- .../microsoft-defender-atp/network-protection.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/network-protection.md b/windows/security/threat-protection/microsoft-defender-atp/network-protection.md index 0b6737027d..ce1b2006f7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/network-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/network-protection.md @@ -11,7 +11,6 @@ ms.localizationpriority: medium audience: ITPro author: denisebmsft ms.author: deniseb -ms.date: 04/30/2019 ms.reviewer: manager: dansimp ms.custom: asr @@ -33,7 +32,7 @@ Network protection expands the scope of [Microsoft Defender SmartScreen](../micr Network protection is supported beginning with Windows 10, version 1709. -For more details about how to enable network protection, see [Enable network protection](enable-network-protection.md). Use Group Policy, PowerShell, or MDM CSPs to enable and manage network protection in your network. +For more information about how to enable network protection, see [Enable network protection](enable-network-protection.md). Use Group Policy, PowerShell, or MDM CSPs to enable and manage network protection in your network. > [!TIP] > You can visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. @@ -46,7 +45,7 @@ You can also use [audit mode](audit-windows-defender.md) to evaluate how Network ## Requirements -Network protection requires Windows 10 Pro, Enterprise E3, E5 and Microsoft Defender AV real-time protection. +Network protection requires Windows 10 Pro, Enterprise E3, E5, and Microsoft Defender AV real-time protection. Windows 10 version | Microsoft Defender Antivirus -|- @@ -76,7 +75,7 @@ You can review the Windows event log to see events that are created when network 1. [Copy the XML directly](event-views.md). -2. Click **OK**. +2. Select **OK**. 3. This will create a custom view that filters to only show the following events related to network protection: @@ -88,6 +87,6 @@ You can review the Windows event log to see events that are created when network ## Related articles -- [Evaluate network protection](evaluate-network-protection.md) | Undertake a quick scenario that demonstrate how the feature works, and what events would typically be created. +- [Evaluate network protection](evaluate-network-protection.md) | Undertake a quick scenario that demonstrates how the feature works, and what events would typically be created. - [Enable network protection](enable-network-protection.md) | Use Group Policy, PowerShell, or MDM CSPs to enable and manage network protection in your network. From 91c990c82656292d74841b1619ea33d2a8739057 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 18:10:38 -0800 Subject: [PATCH 103/206] Update customize-controlled-folders.md --- .../customize-controlled-folders.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/customize-controlled-folders.md b/windows/security/threat-protection/microsoft-defender-atp/customize-controlled-folders.md index 629775a962..8c2ab186eb 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/customize-controlled-folders.md +++ b/windows/security/threat-protection/microsoft-defender-atp/customize-controlled-folders.md @@ -1,6 +1,6 @@ --- title: Customize controlled folder access -description: Add additional folders that should be protected by controlled folder access, or allow apps that are incorrectly blocking changes to important files. +description: Add other folders that should be protected by controlled folder access, or allow apps that are incorrectly blocking changes to important files. keywords: Controlled folder access, windows 10, windows defender, ransomware, protect, files, folders, customize, add folder, add app, allow, add executable search.product: eADQiWindows 10XVcnh ms.prod: w10 @@ -12,7 +12,7 @@ author: denisebmsft ms.author: deniseb ms.reviewer: jcedola, dbodorin, vladiso, nixanm, anvascon manager: dansimp -ms.date: 12/16/2020 +ms.date: 01/06/2021 --- # Customize controlled folder access @@ -38,7 +38,7 @@ This article describes how to customize controlled folder access capabilities, a ## Protect additional folders -Controlled folder access applies to a number of system folders and default locations, including folders such as **Documents**, **Pictures**, and **Movies**. You can add additional folders to be protected, but you cannot remove the default folders in the default list. +Controlled folder access applies to many system folders and default locations, including folders such as **Documents**, **Pictures**, and **Movies**. You can add additional folders to be protected, but you cannot remove the default folders in the default list. Adding other folders to controlled folder access can be helpful for cases when you don't store files in the default Windows libraries, or you've changed the default location of your libraries. @@ -72,7 +72,7 @@ You can use the Windows Security app, Group Policy, PowerShell cmdlets, or mobil ### Use PowerShell to protect additional folders -1. Type **powershell** in the Start menu, right-click **Windows PowerShell** and select **Run as administrator** +1. Type **PowerShell** in the Start menu, right-click **Windows PowerShell** and select **Run as administrator** 2. Enter the following cmdlet: @@ -125,7 +125,7 @@ An allowed application or service only has write access to a controlled folder a ### Use PowerShell to allow specific apps -1. Type **powershell** in the Start menu, right-click **Windows PowerShell** and select **Run as administrator** +1. Type **PowerShell** in the Start menu, right-click **Windows PowerShell** and select **Run as administrator** 2. Enter the following cmdlet: ```PowerShell From bca7802e363b4a98f84ff922bf4250e6e444a1a1 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 18:13:59 -0800 Subject: [PATCH 104/206] Update configure-remediation-microsoft-defender-antivirus.md --- ...emediation-microsoft-defender-antivirus.md | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md index cc8fa8dec9..b080c70faa 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md @@ -11,7 +11,7 @@ ms.localizationpriority: medium author: denisebmsft ms.author: deniseb ms.custom: nextgen -ms.date: 09/03/2018 +ms.date: 01/06/2021 ms.reviewer: manager: dansimp --- @@ -39,20 +39,20 @@ To configure these settings: 1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and select **Administrative templates**. 3. Expand the tree to **Windows components > Microsoft Defender Antivirus** and then the **Location** specified in the table below. -4. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings. +4. Select the policy **Setting** as specified in the table below, and set the option to your desired configuration. Select **OK**, and repeat for any other settings. -Location | Setting | Description | Default setting (if not configured) ----|---|---|--- -Scan | Create a system restore point | A system restore point will be created each day before cleaning or scanning is attempted | Disabled -Scan | Turn on removal of items from scan history folder | Specify how many days items should be kept in the scan history | 30 days -Root | Turn off routine remediation | You can specify whether Microsoft Defender Antivirus automatically remediates threats, or if it should ask the endpoint user what to do. | Disabled (threats are remediated automatically) -Quarantine | Configure removal of items from Quarantine folder | Specify how many days items should be kept in quarantine before being removed | Never removed -Threats | Specify threat alert levels at which default action should not be taken when detected | Every threat that is detected by Microsoft Defender Antivirus is assigned a threat level (low, medium, high, or severe). You can use this setting to define how all threats for each of the threat levels should be remediated (quarantined, removed, or ignored) | Not applicable -Threats | Specify threats upon which default action should not be taken when detected | Specify how specific threats (using their threat ID) should be remediated. You can specify whether the specific threat should be quarantined, removed, or ignored | Not applicable +|Location | Setting | Description | Default setting (if not configured) | +|:---|:---|:---|:---| +|Scan | Create a system restore point | A system restore point will be created each day before cleaning or scanning is attempted | Disabled| +|Scan | Turn on removal of items from scan history folder | Specify how many days items should be kept in the scan history | 30 days | +|Root | Turn off routine remediation | You can specify whether Microsoft Defender Antivirus automatically remediates threats, or if it should ask the endpoint user what to do. | Disabled (threats are remediated automatically) | +|Quarantine | Configure removal of items from Quarantine folder | Specify how many days items should be kept in quarantine before being removed | Never removed | +|Threats | Specify threat alert levels at which default action should not be taken when detected | Every threat that is detected by Microsoft Defender Antivirus is assigned a threat level (low, medium, high, or severe). You can use this setting to define how all threats for each of the threat levels should be remediated (quarantined, removed, or ignored) | Not applicable | +|Threats | Specify threats upon which default action should not be taken when detected | Specify how specific threats (using their threat ID) should be remediated. You can specify whether the specific threat should be quarantined, removed, or ignored | Not applicable | > [!IMPORTANT] > Microsoft Defender Antivirus detects and remediates files based on many factors. Sometimes, completing a remediation requires a reboot. Even if the detection is later determined to be a false positive, the reboot must be completed to ensure all additional remediation steps have been completed. From 94e5652bdd38b7899b06f768ef34a901700d2fdc Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 18:16:46 -0800 Subject: [PATCH 105/206] Update common-exclusion-mistakes-microsoft-defender-antivirus.md --- ...n-mistakes-microsoft-defender-antivirus.md | 80 +++++++++---------- 1 file changed, 40 insertions(+), 40 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md index 58cd36777d..8e12b6b966 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md @@ -21,12 +21,12 @@ manager: dansimp You can define an exclusion list for items that you don't want Microsoft Defender Antivirus to scan. Such excluded items could contain threats that make your device vulnerable. -This topic describes some common mistake that you should avoid when defining exclusions. +This article describes some common mistake that you should avoid when defining exclusions. Before defining your exclusion lists, see [Recommendations for defining exclusions](configure-exclusions-microsoft-defender-antivirus.md#recommendations-for-defining-exclusions). ## Excluding certain trusted items -There are certain files, file types, folders, or processes that you should not exclude from scanning even though you trust them to be not malicious. Refer to the following section for items that you should not exclude from scanning. +Certain files, file types, folders, or processes should not be excluded from scanning even though you trust them to be not malicious. Refer to the following section for items that you should not exclude from scanning. **Do not add exclusions for the following folder locations:** @@ -61,44 +61,44 @@ There are certain files, file types, folders, or processes that you should not e - C:\Windows\Temp\* **Do not add exclusions for the following file extensions:** -- .7zip -- .bat -- .bin -- .cab -- .cmd -- .com -- .cpl -- .dll -- .exe -- .fla -- .gif -- .gz -- .hta -- .inf -- .java -- .jar -- .job -- .jpeg -- .jpg -- .js -- .ko -- .ko.gz -- .msi -- .ocx -- .png -- .ps1 -- .py -- .rar -- .reg -- .scr -- .sys -- .tar -- .tmp -- .url -- .vbe -- .vbs -- .wsf -- .zip +- `.7zip` +- `.bat` +- `.bin` +- `.cab` +- `.cmd` +- `.com` +- `.cpl` +- `.dll` +- `.exe` +- `.fla` +- `.gif` +- `.gz` +- `.hta` +- `.inf` +- `.java` +- `.jar` +- `.job` +- `.jpeg` +- `.jpg` +- `.js` +- `.ko` +- `.ko.gz` +- `.msi` +- `.ocx` +- `.png` +- `.ps1` +- `.py` +- `.rar` +- `.reg` +- `.scr` +- `.sys` +- `.tar` +- `.tmp` +- `.url` +- `.vbe` +- `.vbs` +- `.wsf` +- `.zip` >[!NOTE] > You can chose to exclude file types, such as .gif, .jpg, .jpeg, .png if your environment has a modern, up-to-date software with a strict update policy to handle any vulnerabilities. From 95caab5d1850238686ae630d70e10d65379a7dcd Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 18:17:50 -0800 Subject: [PATCH 106/206] Update common-exclusion-mistakes-microsoft-defender-antivirus.md --- .../common-exclusion-mistakes-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md index 8e12b6b966..d33ce3552f 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md @@ -150,7 +150,7 @@ Do not use a single exclusion list to define exclusions for multiple server work Microsoft Defender Antivirus Service runs in system context using the LocalSystem account, which means it gets information from the system environment variable, and not from the user environment variable. Use of environment variables as a wildcard in exclusion lists is limited to system variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. Therefore, do not use user environment variables as wildcards when adding Microsoft Defender Antivirus folder and process exclusions. See the table under [System environment variables](configure-extension-file-exclusions-microsoft-defender-antivirus.md#system-environment-variables) for a complete list of system environment variables. See [Use wildcards in the file name and folder path or extension exclusion lists](configure-extension-file-exclusions-microsoft-defender-antivirus.md#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists) for information on how to use wildcards in exclusion lists. -## Related topics +## Related articles - [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) - [Configure and validate exclusions based on file extension and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md) From 77e349339171392fe1520fde896011843551c35e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 18:22:32 -0800 Subject: [PATCH 107/206] Update exploit-protection-reference.md --- .../exploit-protection-reference.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md index 99f4521685..8219039c09 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md @@ -11,7 +11,7 @@ ms.localizationpriority: medium audience: ITPro author: denisebmsft ms.author: deniseb -ms.date: 07/20/2020 +ms.date: 01/06/2021 ms.reviewer: cjacks manager: dansimp ms.custom: asr @@ -223,7 +223,7 @@ Block low integrity images will prevent the application from loading files that ### Description -Block remote images will prevent the application from loading files that are hosted on a remote device, such as a UNC share. This helps protect against loading binaries into memory that are on an external device controlled by the attacker. +Blocking remote images helps to prevent the application from loading files that are hosted on a remote device, such as a UNC share. Blocking remote images helps protect against loading binaries into memory that are on an external device controlled by the attacker. This mitigation will block image loads if the image is determined to be on a remote device. It is implemented by the memory manager, which blocks the file from being mapped into memory. If an application attempts to map a remote file, it will trigger a STATUS_ACCESS_DENIED error. @@ -257,7 +257,7 @@ The most common use of fonts outside of the system fonts directory is with [web ### Description -Code integrity guard ensures that all binaries loaded into a process are digitally signed by Microsoft. This includes [WHQL](https://docs.microsoft.com/windows-hardware/drivers/install/whql-release-signature) (Windows Hardware Quality Labs) signatures, which will allow WHQL-approved drivers to run within the process. +Code integrity guard ensures that all binaries loaded into a process are digitally signed by Microsoft. Code integrity guard includes [WHQL](https://docs.microsoft.com/windows-hardware/drivers/install/whql-release-signature) (Windows Hardware Quality Labs) signatures, which will allow WHQL-approved drivers to run within the process. This mitigation is implemented within the memory manager, which blocks the binary from being mapped into memory. If you attempt to load a binary that is not signed by Microsoft, the memory manger will return the error STATUS_INVALID_IMAGE_HASH. By blocking at the memory manager level, this prevents both binaries loaded by the process and binaries injected into the process. @@ -275,9 +275,9 @@ This mitigation specifically blocks any binary that is not signed by Microsoft. ### Description -Control flow guard (CFG) mitigates the risk of attackers leveraging memory corruption vulnerabilities by protecting indirect function calls. For example, an attacker may user a buffer overflow vulnerability to overwrite memory containing a function pointer, and replace that function pointer with a pointer to executable code of their choice (which may also have been injected into the program). +Control flow guard (CFG) mitigates the risk of attackers using memory corruption vulnerabilities by protecting indirect function calls. For example, an attacker may user a buffer overflow vulnerability to overwrite memory containing a function pointer, and replace that function pointer with a pointer to executable code of their choice (which may also have been injected into the program). -This mitigation is provided by injecting an additional check at compile time. Before each indirect function call, additional instructions are added which verify that the target is a valid call target before it is called. If the target is not a valid call target, then the application is terminated. As such, only applications that are compiled with CFG support can benefit from this mitigation. +This mitigation is provided by injecting another check at compile time. Before each indirect function call, another instructions are added which verify that the target is a valid call target before it is called. If the target is not a valid call target, then the application is terminated. As such, only applications that are compiled with CFG support can benefit from this mitigation. The check for a valid target is provided by the Windows kernel. When executable files are loaded, the metadata for indirect call targets is extracted at load time and marked as valid call targets. Additionally, when memory is allocated and marked as executable (such as for generated code), these memory locations are also marked as valid call targets, to support mechanisms such as JIT compilation. @@ -296,7 +296,7 @@ Since applications must be compiled to support CFG, they implicitly declare thei ### Description -Data execution prevention (DEP) prevents memory that was not explicitly allocated as executable from being executed. This helps protect against an attacker injecting malicious code into the process, such as through a buffer overflow, and then executing that code. +Data execution prevention (DEP) prevents memory that was not explicitly allocated as executable from being executed. DEP helps protect against an attacker injecting malicious code into the process, such as through a buffer overflow, and then executing that code. If you attempt to set the instruction pointer to a memory address not marked as executable, the processor will throw an exception (general-protection violation), causing the application to crash. @@ -304,7 +304,7 @@ If you attempt to set the instruction pointer to a memory address not marked as All x64, ARM, and ARM-64 executables have DEP enabled by default, and it cannot be disabled. Since an application will have never been executed without DEP, compatibility is assumed. -All x86 (32-bit) binaries will have DEP enabled by default, but it can be disabled per process. Some old legacy applications, typically applications developed prior to Windows XP SP2, may not be compatible with DEP. These are typically applications that dynamically generate code (for example, JIT compiling) or link to older libraries (such as older versions of ATL) which dynamically generate code. +All x86 (32-bit) binaries have DEP enabled by default, but DEP can be disabled per process. Some old legacy applications, typically applications developed prior to Windows XP SP2, might not be compatible with DEP. Such applications typically generate code dynamically (for example, JIT compiling) or link to older libraries (such as older versions of ATL) which dynamically generate code. ### Configuration options From c299ce4d7580d99d6c07722d5ea5cc85c849816a Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 18:23:39 -0800 Subject: [PATCH 108/206] Update exploit-protection-reference.md --- .../exploit-protection-reference.md | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md index 8219039c09..fbbb9f9107 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md @@ -324,7 +324,7 @@ This includes: ### Compatibility considerations -Most of these extension points are relatively infrequently used, so compatibility impact is typically small, particularly at an individual application level. The one consideration is if users are using third party Legacy IMEs that will not work with the protected application. +Most of these extension points are relatively infrequently used, so compatibility impact is typically small, particularly at an individual application level. The one consideration is if users are using third-party Legacy IMEs that will not work with the protected application. ### Configuration options @@ -341,7 +341,7 @@ Win32k.sys provides a broad attack surface for an attacker. As a kernel-mode com ### Compatibility considerations -This mitigation is designed for processes that are dedicated non-UI processes. For example, many modern browsers will leverage process isolation and incorporate non-UI processes. Any application that displays a GUI using a single process will be impacted by this mitigation. +This mitigation is designed for processes that are dedicated non-UI processes. For example, many modern browsers will use process isolation and incorporate non-UI processes. Any application that displays a GUI using a single process will be impacted by this mitigation. ### Configuration options @@ -379,18 +379,18 @@ This mitigation is primarily an issue for applications such as debuggers, sandbo ### Configuration options -**Validate access for modules that are commonly abused by exploits** - This option, also known as EAF+, adds protections for additional commonly attacked modules: +**Validate access for modules that are commonly abused by exploits** - This option, also known as EAF+, adds protections for other commonly attacked modules: -- mshtml.dll -- flash*.ocx -- jscript*.ocx -- vbscript.dll -- vgx.dll -- mozjs.dll -- xul.dll -- acrord32.dll -- acrofx32.dll -- acroform.api +- `mshtml.dll` +- `flash*.ocx` +- `jscript*.ocx` +- `vbscript.dll` +- `vgx.dll` +- `mozjs.dll` +- `xul.dll` +- `acrord32.dll` +- `acrofx32.dll` +- `acroform.api` Additionally, by enabling EAF+, this mitigation adds the PAGE_GUARD protection to the page containing the "MZ" header, the first two bytes of the [DOS header in a PE file](https://docs.microsoft.com/windows/win32/debug/pe-format#ms-dos-stub-image-only), which is another aspect of known memory content which shellcode can look for to identify modules potentially of interest in memory. From 15da08b047ded1955d26389dd8f62cb9d275c03c Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 18:24:51 -0800 Subject: [PATCH 109/206] Update exploit-protection-reference.md --- .../exploit-protection-reference.md | 50 +++++++++---------- 1 file changed, 25 insertions(+), 25 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md index fbbb9f9107..68401d1360 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md @@ -427,31 +427,31 @@ The memory pages for all protected APIs will have the [PAGE_GUARD](https://docs. This mitigation protects the following Windows APIs: -- GetProcAddress -- GetProcAddressForCaller -- LoadLibraryA -- LoadLibraryExA -- LoadLibraryW -- LoadLibraryExW -- LdrGetProcedureAddress -- LdrGetProcedureAddressEx -- LdrGetProcedureAddressForCaller -- LdrLoadDll -- VirtualProtect -- VirtualProtectEx -- VirtualAlloc -- VirtualAllocEx -- NtAllocateVirtualMemory -- NtProtectVirtualMemory -- CreateProcessA -- CreateProcessW -- WinExec -- CreateProcessAsUserA -- CreateProcessAsUserW -- GetModuleHandleA -- GetModuleHandleW -- RtlDecodePointer -- DecodePointer +- `GetProcAddress` +- `GetProcAddressForCaller` +- `LoadLibraryA` +- `LoadLibraryExA` +- `LoadLibraryW` +- `LoadLibraryExW` +- `LdrGetProcedureAddress` +- `LdrGetProcedureAddressEx` +- `LdrGetProcedureAddressForCaller` +- `LdrLoadDll` +- `VirtualProtect` +- `VirtualProtectEx` +- `VirtualAlloc` +- `VirtualAllocEx` +- `NtAllocateVirtualMemory` +- `NtProtectVirtualMemory` +- `CreateProcessA` +- `CreateProcessW` +- `WinExec` +- `CreateProcessAsUserA` +- `CreateProcessAsUserW` +- `GetModuleHandleA` +- `GetModuleHandleW` +- `RtlDecodePointer` +- `DecodePointer` ### Compatibility considerations From 13afd5971a6fa8f0a729e7b19a9e171226cda9e8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 18:27:05 -0800 Subject: [PATCH 110/206] Update exploit-protection-reference.md --- .../exploit-protection-reference.md | 136 +++++++++--------- 1 file changed, 68 insertions(+), 68 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md index 68401d1360..57e45c13c2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md @@ -488,40 +488,40 @@ Simulate execution (SimExec) is a mitigation for 32-bit applications only. This The APIs intercepted by this mitigation are: -- LoadLibraryA -- LoadLibraryW -- LoadLibraryExA -- LoadLibraryExW -- LdrLoadDll -- VirtualAlloc -- VirtualAllocEx -- NtAllocateVirtualMemory -- VirtualProtect -- VirtualProtectEx -- NtProtectVirtualMemory -- HeapCreate -- RtlCreateHeap -- CreateProcessA -- CreateProcessW -- CreateProcessInternalA -- CreateProcessInternalW -- NtCreateUserProcess -- NtCreateProcess -- NtCreateProcessEx -- CreateRemoteThread -- CreateRemoteThreadEx -- NtCreateThreadEx -- WriteProcessMemory -- NtWriteVirtualMemory -- WinExec -- CreateFileMappingA -- CreateFileMappingW -- CreateFileMappingNumaW -- NtCreateSection -- MapViewOfFile -- MapViewOfFileEx -- MapViewOfFileFromApp -- LdrGetProcedureAddressForCaller +- `LoadLibraryA` +- `LoadLibraryW` +- `LoadLibraryExA` +- `LoadLibraryExW` +- `LdrLoadDll` +- `VirtualAlloc` +- `VirtualAllocEx` +- `NtAllocateVirtualMemory` +- `VirtualProtect` +- `VirtualProtectEx` +- `NtProtectVirtualMemory` +- `HeapCreate` +- `RtlCreateHeap` +- `CreateProcessA` +- `CreateProcessW` +- `CreateProcessInternalA` +- `CreateProcessInternalW` +- `NtCreateUserProcess` +- `NtCreateProcess` +- `NtCreateProcessEx` +- `CreateRemoteThread` +- `CreateRemoteThreadEx` +- `NtCreateThreadEx` +- `WriteProcessMemory` +- `NtWriteVirtualMemory` +- `WinExec` +- `CreateFileMappingA` +- `CreateFileMappingW` +- `CreateFileMappingNumaW` +- `NtCreateSection` +- `MapViewOfFile` +- `MapViewOfFileEx` +- `MapViewOfFileFromApp` +- `LdrGetProcedureAddressForCaller` If a ROP gadget is detected, the process is terminated. @@ -543,40 +543,40 @@ Validate API invocation (CallerCheck) is a mitigation for return-oriented progra The APIs intercepted by this mitigation are: -- LoadLibraryA -- LoadLibraryW -- LoadLibraryExA -- LoadLibraryExW -- LdrLoadDll -- VirtualAlloc -- VirtualAllocEx -- NtAllocateVirtualMemory -- VirtualProtect -- VirtualProtectEx -- NtProtectVirtualMemory -- HeapCreate -- RtlCreateHeap -- CreateProcessA -- CreateProcessW -- CreateProcessInternalA -- CreateProcessInternalW -- NtCreateUserProcess -- NtCreateProcess -- NtCreateProcessEx -- CreateRemoteThread -- CreateRemoteThreadEx -- NtCreateThreadEx -- WriteProcessMemory -- NtWriteVirtualMemory -- WinExec -- CreateFileMappingA -- CreateFileMappingW -- CreateFileMappingNumaW -- NtCreateSection -- MapViewOfFile -- MapViewOfFileEx -- MapViewOfFileFromApp -- LdrGetProcedureAddressForCaller +- `LoadLibraryA` +- `LoadLibraryW` +- `LoadLibraryExA` +- `LoadLibraryExW` +- `LdrLoadDll` +- `VirtualAlloc` +- `VirtualAllocEx` +- `NtAllocateVirtualMemory` +- `VirtualProtect` +- `VirtualProtectEx` +- `NtProtectVirtualMemory` +- `HeapCreate` +- `RtlCreateHeap` +- `CreateProcessA` +- `CreateProcessW` +- `CreateProcessInternalA` +- `CreateProcessInternalW` +- `NtCreateUserProcess` +- `NtCreateProcess` +- `NtCreateProcessEx` +- `CreateRemoteThread` +- `CreateRemoteThreadEx` +- `NtCreateThreadEx` +- `WriteProcessMemory` +- `NtWriteVirtualMemory` +- `WinExec` +- `CreateFileMappingA` +- `CreateFileMappingW` +- `CreateFileMappingNumaW` +- `NtCreateSection` +- `MapViewOfFile` +- `MapViewOfFileEx` +- `MapViewOfFileFromApp` +- `LdrGetProcedureAddressForCaller` If a ROP gadget is detected, the process is terminated. From 18627d1a1ee38d1838c808471c2f1f11d62ebf2c Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 18:29:47 -0800 Subject: [PATCH 111/206] Update exploit-protection-reference.md --- .../exploit-protection-reference.md | 68 +++++++++---------- 1 file changed, 34 insertions(+), 34 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md index 57e45c13c2..e7ee3c6454 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md @@ -676,40 +676,40 @@ This mitigation intercepts a number of Windows APIs, and inspects the value of t The APIs intercepted by this mitigation are: -- LoadLibraryA -- LoadLibraryW -- LoadLibraryExA -- LoadLibraryExW -- LdrLoadDll -- VirtualAlloc -- VirtualAllocEx -- NtAllocateVirtualMemory -- VirtualProtect -- VirtualProtectEx -- NtProtectVirtualMemory -- HeapCreate -- RtlCreateHeap -- CreateProcessA -- CreateProcessW -- CreateProcessInternalA -- CreateProcessInternalW -- NtCreateUserProcess -- NtCreateProcess -- NtCreateProcessEx -- CreateRemoteThread -- CreateRemoteThreadEx -- NtCreateThreadEx -- WriteProcessMemory -- NtWriteVirtualMemory -- WinExec -- CreateFileMappingA -- CreateFileMappingW -- CreateFileMappingNumaW -- NtCreateSection -- MapViewOfFile -- MapViewOfFileEx -- MapViewOfFileFromApp -- LdrGetProcedureAddressForCaller +- `LoadLibraryA` +- `LoadLibraryW` +- `LoadLibraryExA` +- `LoadLibraryExW` +- `LdrLoadDll` +- `VirtualAlloc` +- `VirtualAllocEx` +- `NtAllocateVirtualMemory` +- `VirtualProtect` +- `VirtualProtectEx` +- `NtProtectVirtualMemory` +- `HeapCreate` +- `RtlCreateHeap` +- `CreateProcessA` +- `CreateProcessW` +- `CreateProcessInternalA` +- `CreateProcessInternalW` +- `NtCreateUserProcess` +- `NtCreateProcess` +- `NtCreateProcessEx` +- `CreateRemoteThread` +- `CreateRemoteThreadEx` +- `NtCreateThreadEx` +- `WriteProcessMemory` +- `NtWriteVirtualMemory` +- `WinExec` +- `CreateFileMappingA` +- `CreateFileMappingW` +- `CreateFileMappingNumaW` +- `NtCreateSection` +- `MapViewOfFile` +- `MapViewOfFileEx` +- `MapViewOfFileFromApp` +- `LdrGetProcedureAddressForCaller` ### Compatibility considerations From c255d102968b539afcb363ef7429d8e287f50fec Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 18:32:55 -0800 Subject: [PATCH 112/206] Update exploit-protection-reference.md --- .../exploit-protection-reference.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md index e7ee3c6454..f1867fadcb 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md @@ -400,7 +400,7 @@ Additionally, by enabling EAF+, this mitigation adds the PAGE_GUARD protection t ### Description -Address Space Layout Randomization (ASLR) mitigates the risk of an attacker using their knowledge of the memory layout of the system in order to execute code that is already present in process memory and already marked as executable. This can mitigate the risk of an attacker leveraging techniques such as return-to-libc attacks, where the adversary sets the context and then modifies the return address to execute existing code with context that suits the adversary's purpose. +Address Space Layout Randomization (ASLR) mitigates the risk of an attacker using their knowledge of the memory layout of the system in order to execute code that is already present in process memory and already marked as executable. This can mitigate the risk of an attacker using techniques such as return-to-libc attacks, where the adversary sets the context and then modifies the return address to execute existing code with context that suits the adversary's purpose. Mandatory ASLR forces a rebase of all DLLs within the process. A developer can enable ASLR using the [/DYNAMICBASE](https://docs.microsoft.com/cpp/build/reference/dynamicbase-use-address-space-layout-randomization?view=vs-2019&preserve-view=true) linker option, and this mitigation has the same effect. @@ -471,7 +471,7 @@ The size of the 32-bit address space places practical constraints on the entropy ### Compatibility considerations -Most applications that are compatible with Mandatory ASLR (rebasing) will also be compatible with the additional entropy of Bottom-up ASLR. Some applications may have pointer-truncation issues if they are saving local pointers in 32-bit variables (expecting a base address below 4 GB), and thus will be incompatible with the high entropy option (which can be disabled). +Most applications that are compatible with Mandatory ASLR (rebasing) are also compatible with the other entropy of Bottom-up ASLR. Some applications may have pointer-truncation issues if they are saving local pointers in 32-bit variables (expecting a base address below 4 GB), and thus will be incompatible with the high entropy option (which can be disabled). ### Configuration options @@ -594,7 +594,7 @@ This mitigation is incompatible with the Arbitrary Code Guard mitigation. ### Description -Validate exception chains (SEHOP) is a mitigation against the *Structured Exception Handler (SEH) overwrite* exploitation technique. [Structured exception handling](https://docs.microsoft.com/windows/win32/debug/structured-exception-handling) is the process by which an application can ask to handle a particular exception. Exception handlers are chained together, so that if one exception handler chooses not to handle a particular exception, it can be passed on to the next exception handler in the chain until one decides to handle it. Because the list of handler is dynamic, it is stored on the stack. An attacker can leverage a stack overflow vulnerability to then overwrite the exception handler with a pointer to the code of the attacker's choice. +Validate exception chains (SEHOP) is a mitigation against the *Structured Exception Handler (SEH) overwrite* exploitation technique. [Structured exception handling](https://docs.microsoft.com/windows/win32/debug/structured-exception-handling) is the process by which an application can ask to handle a particular exception. Exception handlers are chained together, so that if one exception handler chooses not to handle a particular exception, it can be passed on to the next exception handler in the chain until one decides to handle it. Because the list of handler is dynamic, it is stored on the stack. An attacker can use a stack overflow vulnerability to then overwrite the exception handler with a pointer to the code of the attacker's choice. This mitigation relies on the design of SEH, where each SEH entry contains both a pointer to the exception handler, as well as a pointer to the next handler in the exception chain. This mitigation is called by the exception dispatcher, which validates the SEH chain when an exception is invoked. It verifies that: @@ -619,7 +619,7 @@ Compatibility issues with SEHOP are relatively rare. It's uncommon for an applic ### Description -*Validate handle usage* is a mitigation that helps protect against an attacker leveraging an existing handle to access a protected object. A [handle](https://docs.microsoft.com/windows/win32/sysinfo/handles-and-objects) is a reference to a protected object. If application code is referencing an invalid handle, that could indicate that an adversary is attempting to use a handle it has previously recorded (but which application reference counting wouldn't be aware of). If the application attempts to use an invalid object, instead of simply returning null, the application will raise an exception (STATUS_INVALID_HANDLE). +*Validate handle usage* is a mitigation that helps protect against an attacker using an existing handle to access a protected object. A [handle](https://docs.microsoft.com/windows/win32/sysinfo/handles-and-objects) is a reference to a protected object. If application code is referencing an invalid handle, that could indicate that an adversary is attempting to use a handle it has previously recorded (but which application reference counting wouldn't be aware of). If the application attempts to use an invalid object, instead of simply returning null, the application will raise an exception (STATUS_INVALID_HANDLE). This mitigation is automatically applied to Windows Store applications. @@ -639,7 +639,7 @@ Applications that were not accurately tracking handle references, and which were The *validate heap integrity* mitigation increases the protection level of heap mitigations in Windows, by causing the application to terminate if a heap corruption is detected. The mitigations include: - Preventing a HEAP handle from being freed -- Performing additional validation on extended block headers for heap allocations +- Performing another validation on extended block headers for heap allocations - Verifying that heap allocations are not already flagged as in-use - Adding guard pages to large allocations, heap segments, and subsegments above a minimum size @@ -672,7 +672,7 @@ Compatibility issues are uncommon. Applications that depend on replacing Windows The *validate stack integrity (StackPivot)* mitigation helps protect against the Stack Pivot attack, a ROP attack where an attacker creates a fake stack in heap memory, and then tricks the application into returning into the fake stack that controls the flow of execution. -This mitigation intercepts a number of Windows APIs, and inspects the value of the stack pointer. If the address of the stack pointer does not fall between the bottom and the top of the stack, then an event is recorded and, if not in audit mode, the process will be terminated. +This mitigation intercepts many Windows APIs, and inspects the value of the stack pointer. If the address of the stack pointer does not fall between the bottom and the top of the stack, then an event is recorded and, if not in audit mode, the process will be terminated. The APIs intercepted by this mitigation are: @@ -713,7 +713,7 @@ The APIs intercepted by this mitigation are: ### Compatibility considerations -Applications that are leveraging fake stacks will be impacted, and there is also a small risk of revealing subtle timing bugs in multi-threaded applications. +Applications that are using fake stacks will be impacted, and there is also a small risk of revealing subtle timing bugs in multi-threaded applications. Applications that perform API interception, particularly security software, can cause compatibility problems with this mitigation. This mitigation is incompatible with the Arbitrary Code Guard mitigation. From 37799450e22422f557a80fc57a3cb55e1fe80a9c Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 18:38:11 -0800 Subject: [PATCH 113/206] Update evaluate-exploit-protection.md --- .../evaluate-exploit-protection.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection.md index a6dcacc047..3885e8407c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection.md @@ -11,7 +11,7 @@ ms.localizationpriority: medium audience: ITPro author: denisebmsft ms.author: deniseb -ms.date: 08/28/2020 +ms.date: 01/06/2021 ms.reviewer: manager: dansimp --- @@ -38,20 +38,20 @@ You can set mitigation in audit mode for specific programs either by using the W ### Windows Security app -1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. +1. Open the Windows Security app by selecting the shield icon in the task bar or searching the start menu for **Defender**. -2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then click **Exploit protection**. +2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then select **Exploit protection**. 3. Go to **Program settings** and choose the app you want to apply protection to: - 1. If the app you want to configure is already listed, click it and then click **Edit** - 2. If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app. + 1. If the app you want to configure is already listed, select it and then select **Edit** + 2. If the app is not listed, at the top of the list select **Add program to customize** and then choose how you want to add the app. - Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location. - Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want. 4. After selecting the app, you'll see a list of all the mitigations that can be applied. Choosing **Audit** will apply the mitigation in audit mode only. You will be notified if you need to restart the process or app, or if you need to restart Windows. -5. Repeat this for all the apps and mitigations you want to configure. Click **Apply** when you're done setting up your configuration. +5. Repeat this for all the apps and mitigations you want to configure. Select **Apply** when you're done setting up your configuration. ### PowerShell From f602e4fb0735f676c481496759b03fe0f76a867a Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 18:39:35 -0800 Subject: [PATCH 114/206] Update evaluate-exploit-protection.md --- .../microsoft-defender-atp/evaluate-exploit-protection.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection.md index 3885e8407c..a7d1eb5399 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection.md @@ -40,18 +40,18 @@ You can set mitigation in audit mode for specific programs either by using the W 1. Open the Windows Security app by selecting the shield icon in the task bar or searching the start menu for **Defender**. -2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then select **Exploit protection**. +2. Select the **App & browser control** tile (or the app icon on the left menu bar) and then select **Exploit protection**. 3. Go to **Program settings** and choose the app you want to apply protection to: 1. If the app you want to configure is already listed, select it and then select **Edit** 2. If the app is not listed, at the top of the list select **Add program to customize** and then choose how you want to add the app. - - Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location. + - Use **Add by program name** to have the mitigation applied to any running process with that name. Specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location. - Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want. 4. After selecting the app, you'll see a list of all the mitigations that can be applied. Choosing **Audit** will apply the mitigation in audit mode only. You will be notified if you need to restart the process or app, or if you need to restart Windows. -5. Repeat this for all the apps and mitigations you want to configure. Select **Apply** when you're done setting up your configuration. +5. Repeat this procedure for all the apps and mitigations you want to configure. Select **Apply** when you're done setting up your configuration. ### PowerShell From 195de92fda8a67c2a9ec2992ca1e7bed4fb7d10b Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 6 Jan 2021 18:41:59 -0800 Subject: [PATCH 115/206] Update deploy-microsoft-defender-antivirus.md --- .../deploy-microsoft-defender-antivirus.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/deploy-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/deploy-microsoft-defender-antivirus.md index 97eeac6ba1..56d70bda19 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/deploy-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/deploy-microsoft-defender-antivirus.md @@ -11,7 +11,7 @@ ms.localizationpriority: medium author: denisebmsft ms.author: deniseb ms.custom: nextgen -ms.date: 09/03/2018 +ms.date: 01/06/2021 ms.reviewer: manager: dansimp --- @@ -29,11 +29,11 @@ Depending on the management tool you are using, you may need to specifically ena See the table in [Deploy, manage, and report on Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md#ref2) for instructions on how to enable protection with Microsoft Intune, Microsoft Endpoint Configuration Manager, Group Policy, Active Directory, Microsoft Azure, PowerShell cmdlets, and Windows Management Instruction (WMI). -Some scenarios require additional guidance on how to successfully deploy or configure Microsoft Defender Antivirus protection, such as Virtual Desktop Infrastructure (VDI) environments. +Some scenarios require more guidance on how to successfully deploy or configure Microsoft Defender Antivirus protection, such as Virtual Desktop Infrastructure (VDI) environments. -The remaining topic in this section provides end-to-end advice and best practices for [setting up Microsoft Defender Antivirus on virtual machines (VMs) in a VDI or Remote Desktop Services (RDS) environment](deployment-vdi-microsoft-defender-antivirus.md). +The remaining article in this section provides end-to-end advice and best practices for [setting up Microsoft Defender Antivirus on virtual machines (VMs) in a VDI or Remote Desktop Services (RDS) environment](deployment-vdi-microsoft-defender-antivirus.md). -## Related topics +## Related articles - [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) - [Deploy, manage updates, and report on Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md) From de8b12ba6ffa680009b12d2665fad81240a67dc0 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 7 Jan 2021 08:00:54 -0800 Subject: [PATCH 116/206] Update windows/security/threat-protection/security-compliance-toolkit-10.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../threat-protection/security-compliance-toolkit-10.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-compliance-toolkit-10.md b/windows/security/threat-protection/security-compliance-toolkit-10.md index e8972cbc75..9aa1555aa0 100644 --- a/windows/security/threat-protection/security-compliance-toolkit-10.md +++ b/windows/security/threat-protection/security-compliance-toolkit-10.md @@ -48,7 +48,7 @@ The Security Compliance Toolkit consists of: - Microsoft Edge security baseline - Version 85 - - Windows Update security baseline +- Windows Update security baseline - Windows 10 20H2 and below (October 2020 Update) - Tools From d36ef29c53ac6d9a49967862ed1937ea10d93541 Mon Sep 17 00:00:00 2001 From: adirdidi <68847945+adirdidi@users.noreply.github.com> Date: Thu, 7 Jan 2021 18:02:05 +0200 Subject: [PATCH 117/206] Update gov.md --- .../microsoft-defender-atp/gov.md | 32 +++++++++---------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/gov.md b/windows/security/threat-protection/microsoft-defender-atp/gov.md index b4e6a21755..397955688f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/gov.md +++ b/windows/security/threat-protection/microsoft-defender-atp/gov.md @@ -45,17 +45,17 @@ Windows 10, version 2004 (with [KB4586853](https://support.microsoft.com/help/44 Windows 10, version 1909 (with [KB4586819](https://support.microsoft.com/help/4586819)) | ![Yes](../images/svg/check-yes.svg) | ![Yes](../images/svg/check-yes.svg) Windows 10, version 1903 (with [KB4586819](https://support.microsoft.com/help/4586819)) | ![Yes](../images/svg/check-yes.svg) | ![Yes](../images/svg/check-yes.svg) Windows 10, version 1809 (with [KB4586839](https://support.microsoft.com/help/4586839)) | ![Yes](../images/svg/check-yes.svg) | ![Yes](../images/svg/check-yes.svg) -Windows 10, version 1803 | ![No](../images/svg/check-no.svg) Coming soon | ![Yes](../images/svg/check-yes.svg) With [KB4499183](https://support.microsoft.com/help/4499183) -Windows 10, version 1709 | ![No](../images/svg/check-no.svg)
    Note: Will not be supported | ![Yes](../images/svg/check-yes.svg) With [KB4499147](https://support.microsoft.com/help/4499147)
    Note: Will be deprecated, please upgrade +Windows 10, version 1803 | ![No](../images/svg/check-no.svg) Rolling out | ![Yes](../images/svg/check-yes.svg) With [KB4499183](https://support.microsoft.com/help/4499183) +Windows 10, version 1709 | ![No](../images/svg/check-no.svg)
    Note: Will not be supported | ![Yes](../images/svg/check-yes.svg) With [KB4499147](https://support.microsoft.com/help/4499147)
    Note: [Deprecated](https://docs.microsoft.com/lifecycle/announcements/revised-end-of-service-windows-10-1709), please upgrade Windows 10, version 1703 and earlier | ![No](../images/svg/check-no.svg)
    Note: Will not be supported | ![No](../images/svg/check-no.svg)
    Note: Will not be supported Windows Server 2019 (with [KB4586839](https://support.microsoft.com/help/4586839)) | ![Yes](../images/svg/check-yes.svg) | ![Yes](../images/svg/check-yes.svg) -Windows Server 2016 | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development -Windows Server 2012 R2 | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development -Windows Server 2008 R2 SP1 | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development -Windows 8.1 Enterprise | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development -Windows 8 Pro | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development -Windows 7 SP1 Enterprise | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development -Windows 7 SP1 Pro | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development +Windows Server 2016 | ![No](../images/svg/check-no.svg) Rolling out | ![No](../images/svg/check-no.svg) In development +Windows Server 2012 R2 | ![No](../images/svg/check-no.svg) Rolling out | ![No](../images/svg/check-no.svg) In development +Windows Server 2008 R2 SP1 | ![No](../images/svg/check-no.svg) Rolling out | ![No](../images/svg/check-no.svg) In development +Windows 8.1 Enterprise | ![No](../images/svg/check-no.svg) Rolling out | ![No](../images/svg/check-no.svg) In development +Windows 8 Pro | ![No](../images/svg/check-no.svg) Rolling out | ![No](../images/svg/check-no.svg) In development +Windows 7 SP1 Enterprise | ![No](../images/svg/check-no.svg) Rolling out | ![No](../images/svg/check-no.svg) In development +Windows 7 SP1 Pro | ![No](../images/svg/check-no.svg) Rolling out | ![No](../images/svg/check-no.svg) In development Mac OS | ![No](../images/svg/check-no.svg) In development | ![No](../images/svg/check-no.svg) In development Linux | ![No](../images/svg/check-no.svg) In development | ![No](../images/svg/check-no.svg) In development iOS | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) @@ -69,9 +69,9 @@ The following OS versions are supported when using [Azure Defender for Servers]( OS version | GCC | GCC High :---|:---|:--- -Windows Server 2016 | ![No](../images/svg/check-no.svg) Coming soon | ![Yes](../images/svg/check-yes.svg) -Windows Server 2012 R2 | ![No](../images/svg/check-no.svg) Coming soon | ![Yes](../images/svg/check-yes.svg) -Windows Server 2008 R2 SP1 | ![No](../images/svg/check-no.svg) Coming soon | ![Yes](../images/svg/check-yes.svg) +Windows Server 2016 | ![No](../images/svg/check-no.svg) Rolling out | ![Yes](../images/svg/check-yes.svg) +Windows Server 2012 R2 | ![No](../images/svg/check-no.svg) Rolling out | ![Yes](../images/svg/check-yes.svg) +Windows Server 2008 R2 SP1 | ![No](../images/svg/check-no.svg) Rolling out | ![Yes](../images/svg/check-yes.svg)
    @@ -108,22 +108,22 @@ Feature name | GCC | GCC High :---|:---|:--- Automated investigation and remediation: Live response | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development Automated investigation and remediation: Response to Office 365 alerts | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) -Email notifications | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development +Email notifications | ![No](../images/svg/check-no.svg) Rolling out | ![No](../images/svg/check-no.svg) In development Evaluation lab | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development Management and APIs: Device health and compliance report | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development Management and APIs: Integration with third-party products | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development -Management and APIs: Streaming API | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development +Management and APIs: Streaming API | ![No](../images/svg/check-no.svg) Rolling out | ![No](../images/svg/check-no.svg) In development Management and APIs: Threat protection report | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development Threat & vulnerability management | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development Threat analytics | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development Web content filtering | ![No](../images/svg/check-no.svg) In development | ![No](../images/svg/check-no.svg) In development -Integrations: Azure Sentinel | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development +Integrations: Azure Sentinel | ![No](../images/svg/check-no.svg) Rolling out | ![No](../images/svg/check-no.svg) In development Integrations: Microsoft Cloud App Security | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) Integrations: Microsoft Compliance Center | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) Integrations: Microsoft Defender for Identity | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) Integrations: Microsoft Defender for Office 365 | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) Integrations: Microsoft Endpoint DLP | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) Integrations: Microsoft Intune | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development -Integrations: Microsoft Power Automate & Azure Logic Apps | ![No](../images/svg/check-no.svg) Coming soon | ![No](../images/svg/check-no.svg) In development +Integrations: Microsoft Power Automate & Azure Logic Apps | ![No](../images/svg/check-no.svg) Rolling out | ![No](../images/svg/check-no.svg) In development Integrations: Skype for Business / Teams | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development Microsoft Threat Experts | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) From 41abac616fa79f7872c48a628aadd81692ed292c Mon Sep 17 00:00:00 2001 From: adirdidi <68847945+adirdidi@users.noreply.github.com> Date: Thu, 7 Jan 2021 18:09:49 +0200 Subject: [PATCH 118/206] Update gov.md --- .../microsoft-defender-atp/gov.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/gov.md b/windows/security/threat-protection/microsoft-defender-atp/gov.md index 397955688f..99fced566c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/gov.md +++ b/windows/security/threat-protection/microsoft-defender-atp/gov.md @@ -58,8 +58,8 @@ Windows 7 SP1 Enterprise | ![No](../images/svg/check-no.svg) Rolling out | ![No] Windows 7 SP1 Pro | ![No](../images/svg/check-no.svg) Rolling out | ![No](../images/svg/check-no.svg) In development Mac OS | ![No](../images/svg/check-no.svg) In development | ![No](../images/svg/check-no.svg) In development Linux | ![No](../images/svg/check-no.svg) In development | ![No](../images/svg/check-no.svg) In development -iOS | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) -Android | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) +iOS | ![No](../images/svg/check-no.svg) On engineering backlog | ![No](../images/svg/check-no.svg) On engineering backlog +Android | ![No](../images/svg/check-no.svg) On engineering backlog | ![No](../images/svg/check-no.svg) On engineering backlog > [!NOTE] > A patch must be deployed before device onboarding in order to configure Defender for Endpoint to the correct environment. @@ -107,7 +107,7 @@ These are the known gaps as of January 2021: Feature name | GCC | GCC High :---|:---|:--- Automated investigation and remediation: Live response | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development -Automated investigation and remediation: Response to Office 365 alerts | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) +Automated investigation and remediation: Response to Office 365 alerts | ![No](../images/svg/check-no.svg) On engineering backlog | ![No](../images/svg/check-no.svg) On engineering backlog Email notifications | ![No](../images/svg/check-no.svg) Rolling out | ![No](../images/svg/check-no.svg) In development Evaluation lab | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development Management and APIs: Device health and compliance report | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development @@ -118,11 +118,11 @@ Threat & vulnerability management | ![Yes](../images/svg/check-yes.svg) | ![No]( Threat analytics | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development Web content filtering | ![No](../images/svg/check-no.svg) In development | ![No](../images/svg/check-no.svg) In development Integrations: Azure Sentinel | ![No](../images/svg/check-no.svg) Rolling out | ![No](../images/svg/check-no.svg) In development -Integrations: Microsoft Cloud App Security | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) -Integrations: Microsoft Compliance Center | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) -Integrations: Microsoft Defender for Identity | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) -Integrations: Microsoft Defender for Office 365 | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) -Integrations: Microsoft Endpoint DLP | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) +Integrations: Microsoft Cloud App Security | ![No](../images/svg/check-no.svg) On engineering backlog | ![No](../images/svg/check-no.svg) On engineering backlog +Integrations: Microsoft Compliance Center | ![No](../images/svg/check-no.svg) On engineering backlog | ![No](../images/svg/check-no.svg) On engineering backlog +Integrations: Microsoft Defender for Identity | ![No](../images/svg/check-no.svg) On engineering backlog | ![No](../images/svg/check-no.svg) On engineering backlog +Integrations: Microsoft Defender for Office 365 | ![No](../images/svg/check-no.svg) On engineering backlog | ![No](../images/svg/check-no.svg) On engineering backlog +Integrations: Microsoft Endpoint DLP | ![No](../images/svg/check-no.svg) On engineering backlog | ![No](../images/svg/check-no.svg) On engineering backlog Integrations: Microsoft Intune | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development Integrations: Microsoft Power Automate & Azure Logic Apps | ![No](../images/svg/check-no.svg) Rolling out | ![No](../images/svg/check-no.svg) In development Integrations: Skype for Business / Teams | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development From e93e2506ceb785ce1b599693af512ae0953c98f7 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 7 Jan 2021 08:34:56 -0800 Subject: [PATCH 119/206] Update edr-in-block-mode.md --- .../microsoft-defender-atp/edr-in-block-mode.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md index f519113f0c..a5a0fd9fb0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md +++ b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md @@ -15,7 +15,7 @@ ms.localizationpriority: medium ms.custom: - next-gen - edr -ms.date: 12/14/2020 +ms.date: 01/07/2021 ms.collection: - m365-security-compliance - m365initiative-defender-endpoint @@ -71,7 +71,7 @@ The following image shows an instance of unwanted software that was detected and |Permissions |Global Administrator or Security Administrator role assigned in [Azure Active Directory](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-portal). See [Basic permissions](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/basic-permissions). | |Operating system |One of the following versions:
    - Windows 10 (all releases)
    - Windows Server 2016 or later | |Windows E5 enrollment |Windows E5 is included in the following subscriptions:
    - Microsoft 365 E5
    - Microsoft 365 E3 together with the Identity & Threat Protection offering

    See [Components](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview?view=o365-worldwide&preserve-view=true#components) and [features and capabilities for each plan](https://www.microsoft.com/microsoft-365/compare-all-microsoft-365-plans). | -|Cloud-delivered protection |Make sure Microsoft Defender Antivirus is configured such that cloud-delivered protection is enabled.

    See [Enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus). | +|Cloud-delivered protection |Microsoft Defender Antivirus must be installed and running in either active mode or passive mode. You can use Microsoft Defender Antivirus alongside another antivirus solution.

    In addition, make sure Microsoft Defender Antivirus is configured such that cloud-delivered protection is enabled. See [Enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus). | |Microsoft Defender Antivirus antimalware client |Make sure your client is up to date. Using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps&preserve-view=true) cmdlet as an administrator.
    In the **AMProductVersion** line, you should see **4.18.2001.10** or above. | |Microsoft Defender Antivirus engine |Make sure your engine is up to date. Using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps&preserve-view=true) cmdlet as an administrator.
    In the **AMEngineVersion** line, you should see **1.1.16700.2** or above. | From cc2e9c09d23fbefc08e6dc675efa95258e30ca08 Mon Sep 17 00:00:00 2001 From: adirdidi <68847945+adirdidi@users.noreply.github.com> Date: Thu, 7 Jan 2021 18:49:14 +0200 Subject: [PATCH 120/206] Update gov.md --- .../security/threat-protection/microsoft-defender-atp/gov.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/gov.md b/windows/security/threat-protection/microsoft-defender-atp/gov.md index 99fced566c..42f48c7a27 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/gov.md +++ b/windows/security/threat-protection/microsoft-defender-atp/gov.md @@ -56,10 +56,10 @@ Windows 8.1 Enterprise | ![No](../images/svg/check-no.svg) Rolling out | ![No](. Windows 8 Pro | ![No](../images/svg/check-no.svg) Rolling out | ![No](../images/svg/check-no.svg) In development Windows 7 SP1 Enterprise | ![No](../images/svg/check-no.svg) Rolling out | ![No](../images/svg/check-no.svg) In development Windows 7 SP1 Pro | ![No](../images/svg/check-no.svg) Rolling out | ![No](../images/svg/check-no.svg) In development -Mac OS | ![No](../images/svg/check-no.svg) In development | ![No](../images/svg/check-no.svg) In development Linux | ![No](../images/svg/check-no.svg) In development | ![No](../images/svg/check-no.svg) In development -iOS | ![No](../images/svg/check-no.svg) On engineering backlog | ![No](../images/svg/check-no.svg) On engineering backlog +Mac OS | ![No](../images/svg/check-no.svg) In development | ![No](../images/svg/check-no.svg) In development Android | ![No](../images/svg/check-no.svg) On engineering backlog | ![No](../images/svg/check-no.svg) On engineering backlog +iOS | ![No](../images/svg/check-no.svg) On engineering backlog | ![No](../images/svg/check-no.svg) On engineering backlog > [!NOTE] > A patch must be deployed before device onboarding in order to configure Defender for Endpoint to the correct environment. From 7ed424f85a07cb639ef44d74510e0b78fc19e086 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 7 Jan 2021 09:22:34 -0800 Subject: [PATCH 121/206] Update edr-in-block-mode.md --- .../edr-in-block-mode.md | 31 ++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md index a5a0fd9fb0..a2071821fe 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md +++ b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md @@ -71,7 +71,7 @@ The following image shows an instance of unwanted software that was detected and |Permissions |Global Administrator or Security Administrator role assigned in [Azure Active Directory](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-portal). See [Basic permissions](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/basic-permissions). | |Operating system |One of the following versions:
    - Windows 10 (all releases)
    - Windows Server 2016 or later | |Windows E5 enrollment |Windows E5 is included in the following subscriptions:
    - Microsoft 365 E5
    - Microsoft 365 E3 together with the Identity & Threat Protection offering

    See [Components](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview?view=o365-worldwide&preserve-view=true#components) and [features and capabilities for each plan](https://www.microsoft.com/microsoft-365/compare-all-microsoft-365-plans). | -|Cloud-delivered protection |Microsoft Defender Antivirus must be installed and running in either active mode or passive mode. You can use Microsoft Defender Antivirus alongside another antivirus solution.

    In addition, make sure Microsoft Defender Antivirus is configured such that cloud-delivered protection is enabled. See [Enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus). | +|Cloud-delivered protection |Microsoft Defender Antivirus must be installed and running in either active mode or passive mode. (If you are using a non-Microsoft antivirus solution, you can still use Microsoft Defender Antivirus. See [How do I confirm Microsoft Defender Antivirus is in active or passive mode?](#how-do-i-confirm-microsoft-defender-antivirus-is-in-active-or-passive-mode).)

    In addition, make sure Microsoft Defender Antivirus is configured such that cloud-delivered protection is enabled. See [Enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus). | |Microsoft Defender Antivirus antimalware client |Make sure your client is up to date. Using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps&preserve-view=true) cmdlet as an administrator.
    In the **AMProductVersion** line, you should see **4.18.2001.10** or above. | |Microsoft Defender Antivirus engine |Make sure your engine is up to date. Using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps&preserve-view=true) cmdlet as an administrator.
    In the **AMEngineVersion** line, you should see **1.1.16700.2** or above. | @@ -97,6 +97,35 @@ Because Microsoft Defender Antivirus detects and remediates malicious items, it' Cloud protection is needed to turn on the feature on the device. Cloud protection allows [Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection) to deliver the latest and greatest protection based on our breadth and depth of security intelligence, along with behavioral and device learning models. +### How do I set Microsoft Defender Antivirus to passive mode? + +See [Enable Microsoft Defender Antivirus and confirm it's in passive mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/switch-to-microsoft-defender-setup#enable-microsoft-defender-antivirus-and-confirm-its-in-passive-mode). + +### How do I confirm Microsoft Defender Antivirus is in active or passive mode? + +To confirm whether Microsoft Defender Antivirus is running in active or passive mode, you can use Command Prompt or PowerShell on a device running Windows. + +#### Use PowerShell + +1. Select the Start menu, begin typing `PowerShell`, and then open Windows PowerShell in the results. + +2. Type `Get-MpComputerStatus`. + +3. In the list of results, look for one of the following: + - `AMRunningMode: Normal` + - `AMRunningMode: Passive Mode` + - `AMRunningMode: SxS Passive Mode` + +To learn more, see [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps). + +#### Use Command Prompt + +1. Select the Start menu, begin typing `Command Prompt`, and then open Windows Command Prompt in the results. + +2. Type `sc query windefend`. + +3. In the list of results, in the `STATE` row, confirm that the service is running. + ## See also - [Tech Community blog: Introducing EDR in block mode: Stopping attacks in their tracks](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/introducing-edr-in-block-mode-stopping-attacks-in-their-tracks/ba-p/1596617) From 2409e91582f8f7b45a60d6f469e2cff43b5e6e4d Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 7 Jan 2021 09:24:52 -0800 Subject: [PATCH 122/206] Update edr-in-block-mode.md --- .../microsoft-defender-atp/edr-in-block-mode.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md index a2071821fe..023c3aad47 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md +++ b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md @@ -71,7 +71,7 @@ The following image shows an instance of unwanted software that was detected and |Permissions |Global Administrator or Security Administrator role assigned in [Azure Active Directory](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-portal). See [Basic permissions](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/basic-permissions). | |Operating system |One of the following versions:
    - Windows 10 (all releases)
    - Windows Server 2016 or later | |Windows E5 enrollment |Windows E5 is included in the following subscriptions:
    - Microsoft 365 E5
    - Microsoft 365 E3 together with the Identity & Threat Protection offering

    See [Components](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview?view=o365-worldwide&preserve-view=true#components) and [features and capabilities for each plan](https://www.microsoft.com/microsoft-365/compare-all-microsoft-365-plans). | -|Cloud-delivered protection |Microsoft Defender Antivirus must be installed and running in either active mode or passive mode. (If you are using a non-Microsoft antivirus solution, you can still use Microsoft Defender Antivirus. See [How do I confirm Microsoft Defender Antivirus is in active or passive mode?](#how-do-i-confirm-microsoft-defender-antivirus-is-in-active-or-passive-mode).)

    In addition, make sure Microsoft Defender Antivirus is configured such that cloud-delivered protection is enabled. See [Enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus). | +|Cloud-delivered protection |Microsoft Defender Antivirus must be installed and running in either active mode or passive mode. (You can use Microsoft Defender Antivirus alongside a non-Microsoft antivirus solution.) See [How do I confirm Microsoft Defender Antivirus is in active or passive mode?](#how-do-i-confirm-microsoft-defender-antivirus-is-in-active-or-passive-mode).)

    In addition, make sure Microsoft Defender Antivirus is configured such that cloud-delivered protection is enabled. See [Enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus). | |Microsoft Defender Antivirus antimalware client |Make sure your client is up to date. Using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps&preserve-view=true) cmdlet as an administrator.
    In the **AMProductVersion** line, you should see **4.18.2001.10** or above. | |Microsoft Defender Antivirus engine |Make sure your engine is up to date. Using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps&preserve-view=true) cmdlet as an administrator.
    In the **AMEngineVersion** line, you should see **1.1.16700.2** or above. | From a3d29f03306322f9a4f4012e1d72a3d0840cb3b2 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 7 Jan 2021 09:26:48 -0800 Subject: [PATCH 123/206] Update edr-in-block-mode.md --- .../microsoft-defender-atp/edr-in-block-mode.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md index 023c3aad47..a85f4dfe14 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md +++ b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md @@ -83,7 +83,7 @@ The following image shows an instance of unwanted software that was detected and ### Do I need to turn EDR in block mode on even when I have Microsoft Defender Antivirus running on devices? -We recommend keeping EDR in block mode on, whether Microsoft Defender Antivirus is running in passive mode or in active mode. EDR in block mode gives you an added layer of defense with Microsoft Defender for Endpoint. It allows Defender for Endpoint to take actions based on post-breach behavioral EDR detections. +We recommend keeping EDR in block mode on, whether Microsoft Defender Antivirus is running in passive mode or in active mode. EDR in block mode provides an additional layer of defense with Microsoft Defender for Endpoint. It allows Defender for Endpoint to take actions based on post-breach behavioral EDR detections. ### Will EDR in block mode have any impact on a user's antivirus protection? From ab4b15a77dead9e2ac42c54cab88e265a914762e Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 7 Jan 2021 09:32:52 -0800 Subject: [PATCH 124/206] Update use.md --- .../security/threat-protection/microsoft-defender-atp/use.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/use.md b/windows/security/threat-protection/microsoft-defender-atp/use.md index 3b37769671..94a305a5eb 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/use.md +++ b/windows/security/threat-protection/microsoft-defender-atp/use.md @@ -36,6 +36,11 @@ Use the **Threat & Vulnerability Management** dashboard to expand your visibilit Use the **Threat analytics** dashboard to continually assess and control risk exposure to Spectre and Meltdown. +## Microsoft Defender for Endpoint interactive guide +In this interactive guide, you'll learn how to investigate threads to your organization with Microsoft Defender for Endpoint. You'll see how Microsoft Defender for Endpoint can help you identify suspicious activities, investigate risks to your organization, and remediate threats. + +[!VIDEO https://aka.ms/MSDE-IG] + ### In this section Topic | Description From b386e6d9848b0d91e02bcc5cc81514fb84fb9e4a Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 7 Jan 2021 09:33:19 -0800 Subject: [PATCH 125/206] Update edr-in-block-mode.md --- .../microsoft-defender-atp/edr-in-block-mode.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md index a85f4dfe14..def71f7250 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md +++ b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md @@ -32,7 +32,7 @@ ms.collection: ## What is EDR in block mode? -When [endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) (EDR) in block mode is turned on, Defender for Endpoint blocks malicious artifacts or behaviors that are observed through post-breach protection. EDR in block mode works behind the scenes to remediate malicious artifacts that are detected, post breach. +[Endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) (EDR) in block mode provides protection from malicious artifacts, even when Microsoft Defender Antivirus is running in passive mode. When turned on, EDR in block mode blocks malicious artifacts or behaviors that are detected on a device. EDR in block mode works behind the scenes to remediate malicious artifacts that are detected post breach. EDR in block mode is also integrated with [threat & vulnerability management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt). Your organization's security team will get a [security recommendation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation) to turn EDR in block mode on if it isn't already enabled. @@ -83,15 +83,15 @@ The following image shows an instance of unwanted software that was detected and ### Do I need to turn EDR in block mode on even when I have Microsoft Defender Antivirus running on devices? -We recommend keeping EDR in block mode on, whether Microsoft Defender Antivirus is running in passive mode or in active mode. EDR in block mode provides an additional layer of defense with Microsoft Defender for Endpoint. It allows Defender for Endpoint to take actions based on post-breach behavioral EDR detections. +We recommend keeping EDR in block mode on, whether Microsoft Defender Antivirus is running in passive mode or in active mode. EDR in block mode provides another layer of defense with Microsoft Defender for Endpoint. It allows Defender for Endpoint to take actions based on post-breach behavioral EDR detections. ### Will EDR in block mode have any impact on a user's antivirus protection? -EDR in block mode does not affect third-party antivirus protection running on users' devices. EDR in block mode works if the primary antivirus solution misses something, or if there is a post-breach detection. EDR in block mode works just like [Microsoft Defender Antivirus in passive mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility#functionality-and-features-available-in-each-state), with the additional steps of blocking and remediating malicious artifacts or behaviors that are detected. +EDR in block mode does not affect third-party antivirus protection running on users' devices. EDR in block mode works if the primary antivirus solution misses something, or if there is a post-breach detection. EDR in block mode works just like [Microsoft Defender Antivirus in passive mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility#functionality-and-features-available-in-each-state), except it also blocks and remediates malicious artifacts or behaviors that are detected. ### Why do I need to keep Microsoft Defender Antivirus up to date? -Because Microsoft Defender Antivirus detects and remediates malicious items, it's important to keep it up to date to leverage the latest device learning models, behavioral detections, and heuristics for EDR in block mode to be most effective. The [Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection) stack of capabilities works in an integrated manner, and to get best protection value, you should keep Microsoft Defender Antivirus up to date. +Because Microsoft Defender Antivirus detects and remediates malicious items, it's important to keep it up to date to use the latest device learning models, behavioral detections, and heuristics for EDR in block mode to be most effective. The [Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection) stack of capabilities works in an integrated manner, and to get best protection value, you should keep Microsoft Defender Antivirus up to date. ### Why do we need cloud protection on? From 898eb448d332fca090a9d76cfef7919bdc1c8d3d Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 7 Jan 2021 09:34:04 -0800 Subject: [PATCH 126/206] Update use.md --- .../security/threat-protection/microsoft-defender-atp/use.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/use.md b/windows/security/threat-protection/microsoft-defender-atp/use.md index 94a305a5eb..081596f1aa 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/use.md +++ b/windows/security/threat-protection/microsoft-defender-atp/use.md @@ -37,7 +37,7 @@ Use the **Threat & Vulnerability Management** dashboard to expand your visibilit Use the **Threat analytics** dashboard to continually assess and control risk exposure to Spectre and Meltdown. ## Microsoft Defender for Endpoint interactive guide -In this interactive guide, you'll learn how to investigate threads to your organization with Microsoft Defender for Endpoint. You'll see how Microsoft Defender for Endpoint can help you identify suspicious activities, investigate risks to your organization, and remediate threats. +In this interactive guide, you'll learn how to investigate threats to your organization with Microsoft Defender for Endpoint. You'll see how Microsoft Defender for Endpoint can help you identify suspicious activities, investigate risks to your organization, and remediate threats. [!VIDEO https://aka.ms/MSDE-IG] From ee3f82a8654f8fa713a7f012af54b21f1c575532 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 7 Jan 2021 09:35:40 -0800 Subject: [PATCH 127/206] Update edr-in-block-mode.md --- .../microsoft-defender-atp/edr-in-block-mode.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md index def71f7250..07e482586e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md +++ b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md @@ -43,7 +43,7 @@ EDR in block mode is also integrated with [threat & vulnerability management](ht ## What happens when something is detected? -When EDR in block mode is turned on, and a malicious artifact is detected, blocking and remediation actions are taken. You'll see detection status as **Blocked** or **Prevented** as completed actions in the [Action center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts#check-activity-details-in-action-center). +When EDR in block mode is turned on, and a malicious artifact is detected, Microsoft Defender for Endpoint blocks and remediates that artifact. You'll see detection status as **Blocked** or **Prevented** as completed actions in the [Action center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts#check-activity-details-in-action-center). The following image shows an instance of unwanted software that was detected and blocked through EDR in block mode: @@ -111,10 +111,10 @@ To confirm whether Microsoft Defender Antivirus is running in active or passive 2. Type `Get-MpComputerStatus`. -3. In the list of results, look for one of the following: - - `AMRunningMode: Normal` - - `AMRunningMode: Passive Mode` - - `AMRunningMode: SxS Passive Mode` +3. In the list of results, in the `AMRunningMode` row, look for one of the following values: + - `Normal` + - `Passive Mode` + - `SxS Passive Mode` To learn more, see [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps). From d8959ac9eb6c8fa7ea36ef2f422bb5cb2411dced Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 7 Jan 2021 09:43:06 -0800 Subject: [PATCH 128/206] Update edr-in-block-mode.md --- .../microsoft-defender-atp/edr-in-block-mode.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md index 07e482586e..9c53fcc49a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md +++ b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md @@ -116,7 +116,7 @@ To confirm whether Microsoft Defender Antivirus is running in active or passive - `Passive Mode` - `SxS Passive Mode` -To learn more, see [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps). +To learn more, see [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus). #### Use Command Prompt From 47fc5b95cbd10bd19059e8ed65b896e53e2b4537 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 7 Jan 2021 09:48:24 -0800 Subject: [PATCH 129/206] Update edr-in-block-mode.md --- .../microsoft-defender-atp/edr-in-block-mode.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md index 9c53fcc49a..79a5673036 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md +++ b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md @@ -71,7 +71,7 @@ The following image shows an instance of unwanted software that was detected and |Permissions |Global Administrator or Security Administrator role assigned in [Azure Active Directory](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-portal). See [Basic permissions](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/basic-permissions). | |Operating system |One of the following versions:
    - Windows 10 (all releases)
    - Windows Server 2016 or later | |Windows E5 enrollment |Windows E5 is included in the following subscriptions:
    - Microsoft 365 E5
    - Microsoft 365 E3 together with the Identity & Threat Protection offering

    See [Components](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview?view=o365-worldwide&preserve-view=true#components) and [features and capabilities for each plan](https://www.microsoft.com/microsoft-365/compare-all-microsoft-365-plans). | -|Cloud-delivered protection |Microsoft Defender Antivirus must be installed and running in either active mode or passive mode. (You can use Microsoft Defender Antivirus alongside a non-Microsoft antivirus solution.) See [How do I confirm Microsoft Defender Antivirus is in active or passive mode?](#how-do-i-confirm-microsoft-defender-antivirus-is-in-active-or-passive-mode).)

    In addition, make sure Microsoft Defender Antivirus is configured such that cloud-delivered protection is enabled. See [Enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus). | +|Cloud-delivered protection |Microsoft Defender Antivirus must be installed and running in either active mode or passive mode. (You can use Microsoft Defender Antivirus alongside a non-Microsoft antivirus solution.) [Confirm Microsoft Defender Antivirus is in active or passive mode](#how-do-i-confirm-microsoft-defender-antivirus-is-in-active-or-passive-mode).

    In addition, make sure Microsoft Defender Antivirus is configured such that cloud-delivered protection is enabled. See [Enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus). | |Microsoft Defender Antivirus antimalware client |Make sure your client is up to date. Using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps&preserve-view=true) cmdlet as an administrator.
    In the **AMProductVersion** line, you should see **4.18.2001.10** or above. | |Microsoft Defender Antivirus engine |Make sure your engine is up to date. Using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps&preserve-view=true) cmdlet as an administrator.
    In the **AMEngineVersion** line, you should see **1.1.16700.2** or above. | From a0a5572da3848dd5bfbfeb11aa85cfb77db8391e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 7 Jan 2021 09:49:24 -0800 Subject: [PATCH 130/206] Update edr-in-block-mode.md --- .../microsoft-defender-atp/edr-in-block-mode.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md index 79a5673036..6344d50b9a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md +++ b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md @@ -71,7 +71,7 @@ The following image shows an instance of unwanted software that was detected and |Permissions |Global Administrator or Security Administrator role assigned in [Azure Active Directory](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-portal). See [Basic permissions](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/basic-permissions). | |Operating system |One of the following versions:
    - Windows 10 (all releases)
    - Windows Server 2016 or later | |Windows E5 enrollment |Windows E5 is included in the following subscriptions:
    - Microsoft 365 E5
    - Microsoft 365 E3 together with the Identity & Threat Protection offering

    See [Components](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview?view=o365-worldwide&preserve-view=true#components) and [features and capabilities for each plan](https://www.microsoft.com/microsoft-365/compare-all-microsoft-365-plans). | -|Cloud-delivered protection |Microsoft Defender Antivirus must be installed and running in either active mode or passive mode. (You can use Microsoft Defender Antivirus alongside a non-Microsoft antivirus solution.) [Confirm Microsoft Defender Antivirus is in active or passive mode](#how-do-i-confirm-microsoft-defender-antivirus-is-in-active-or-passive-mode).

    In addition, make sure Microsoft Defender Antivirus is configured such that cloud-delivered protection is enabled. See [Enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus). | +|Cloud-delivered protection |Microsoft Defender Antivirus must be installed and running in either active mode or passive mode. (You can use Microsoft Defender Antivirus alongside a non-Microsoft antivirus solution.) [Confirm Microsoft Defender Antivirus is in active or passive mode](#how-do-i-confirm-microsoft-defender-antivirus-is-in-active-or-passive-mode).

    In addition, make sure Microsoft Defender Antivirus is configured such that [cloud-delivered protection is enabled](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus). | |Microsoft Defender Antivirus antimalware client |Make sure your client is up to date. Using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps&preserve-view=true) cmdlet as an administrator.
    In the **AMProductVersion** line, you should see **4.18.2001.10** or above. | |Microsoft Defender Antivirus engine |Make sure your engine is up to date. Using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps&preserve-view=true) cmdlet as an administrator.
    In the **AMEngineVersion** line, you should see **1.1.16700.2** or above. | From aa303399ccb7ffb9b9e7445d4f98d9070dfa30f3 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 7 Jan 2021 09:51:01 -0800 Subject: [PATCH 131/206] Update edr-in-block-mode.md --- .../microsoft-defender-atp/edr-in-block-mode.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md index 6344d50b9a..b53e114acc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md +++ b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md @@ -76,8 +76,7 @@ The following image shows an instance of unwanted software that was detected and |Microsoft Defender Antivirus engine |Make sure your engine is up to date. Using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps&preserve-view=true) cmdlet as an administrator.
    In the **AMEngineVersion** line, you should see **1.1.16700.2** or above. | > [!IMPORTANT] -> To get the best protection value, make sure your antivirus solution is configured to receive regular updates and essential features, and that your exclusions are defined. - +> To get the best protection value, make sure your antivirus solution is configured to receive regular updates and essential features, and that your [exclusions](../microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md) are defined. EDR in block mode respects exclusions that are defined for Microsoft Defender Antivirus. ## Frequently asked questions From 29a4ef88256a2ace31d71724ddae949ca09919f9 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 7 Jan 2021 09:57:51 -0800 Subject: [PATCH 132/206] Update use.md --- .../security/threat-protection/microsoft-defender-atp/use.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/use.md b/windows/security/threat-protection/microsoft-defender-atp/use.md index 081596f1aa..eeeba70ccd 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/use.md +++ b/windows/security/threat-protection/microsoft-defender-atp/use.md @@ -39,7 +39,7 @@ Use the **Threat analytics** dashboard to continually assess and control risk ex ## Microsoft Defender for Endpoint interactive guide In this interactive guide, you'll learn how to investigate threats to your organization with Microsoft Defender for Endpoint. You'll see how Microsoft Defender for Endpoint can help you identify suspicious activities, investigate risks to your organization, and remediate threats. -[!VIDEO https://aka.ms/MSDE-IG] +> [!VIDEO https://aka.ms/MSDE-IG] ### In this section From 47dac969b5512a26efdf3578cdee4ed0a982ed54 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 7 Jan 2021 10:00:11 -0800 Subject: [PATCH 133/206] Update edr-in-block-mode.md --- .../microsoft-defender-atp/edr-in-block-mode.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md index b53e114acc..5300626bd2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md +++ b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md @@ -71,7 +71,8 @@ The following image shows an instance of unwanted software that was detected and |Permissions |Global Administrator or Security Administrator role assigned in [Azure Active Directory](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-portal). See [Basic permissions](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/basic-permissions). | |Operating system |One of the following versions:
    - Windows 10 (all releases)
    - Windows Server 2016 or later | |Windows E5 enrollment |Windows E5 is included in the following subscriptions:
    - Microsoft 365 E5
    - Microsoft 365 E3 together with the Identity & Threat Protection offering

    See [Components](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview?view=o365-worldwide&preserve-view=true#components) and [features and capabilities for each plan](https://www.microsoft.com/microsoft-365/compare-all-microsoft-365-plans). | -|Cloud-delivered protection |Microsoft Defender Antivirus must be installed and running in either active mode or passive mode. (You can use Microsoft Defender Antivirus alongside a non-Microsoft antivirus solution.) [Confirm Microsoft Defender Antivirus is in active or passive mode](#how-do-i-confirm-microsoft-defender-antivirus-is-in-active-or-passive-mode).

    In addition, make sure Microsoft Defender Antivirus is configured such that [cloud-delivered protection is enabled](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus). | +|Microsoft Defender Antivirus |Microsoft Defender Antivirus must be installed and running in either active mode or passive mode. (You can use Microsoft Defender Antivirus alongside a non-Microsoft antivirus solution.) [Confirm Microsoft Defender Antivirus is in active or passive mode](#how-do-i-confirm-microsoft-defender-antivirus-is-in-active-or-passive-mode). | +|Cloud-delivered protection |Make sure Microsoft Defender Antivirus is configured such that [cloud-delivered protection is enabled](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus). | |Microsoft Defender Antivirus antimalware client |Make sure your client is up to date. Using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps&preserve-view=true) cmdlet as an administrator.
    In the **AMProductVersion** line, you should see **4.18.2001.10** or above. | |Microsoft Defender Antivirus engine |Make sure your engine is up to date. Using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps&preserve-view=true) cmdlet as an administrator.
    In the **AMEngineVersion** line, you should see **1.1.16700.2** or above. | From 40762f3bbd912ef4cc766dd2c6130295b4f578d8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 7 Jan 2021 10:06:13 -0800 Subject: [PATCH 134/206] Update edr-in-block-mode.md --- .../microsoft-defender-atp/edr-in-block-mode.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md index 5300626bd2..8f97a4b56f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md +++ b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md @@ -77,7 +77,7 @@ The following image shows an instance of unwanted software that was detected and |Microsoft Defender Antivirus engine |Make sure your engine is up to date. Using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps&preserve-view=true) cmdlet as an administrator.
    In the **AMEngineVersion** line, you should see **1.1.16700.2** or above. | > [!IMPORTANT] -> To get the best protection value, make sure your antivirus solution is configured to receive regular updates and essential features, and that your [exclusions](../microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md) are defined. EDR in block mode respects exclusions that are defined for Microsoft Defender Antivirus. +> To get the best protection value, make sure your antivirus solution is configured to receive regular updates and essential features, and that your [exclusions are configured](../microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md). EDR in block mode respects exclusions that are defined for Microsoft Defender Antivirus. ## Frequently asked questions From afaf7b099df4b8a2387318097aeb79d53dcade08 Mon Sep 17 00:00:00 2001 From: adirdidi <68847945+adirdidi@users.noreply.github.com> Date: Thu, 7 Jan 2021 22:13:32 +0200 Subject: [PATCH 135/206] Update gov.md --- .../security/threat-protection/microsoft-defender-atp/gov.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/gov.md b/windows/security/threat-protection/microsoft-defender-atp/gov.md index 42f48c7a27..a8904d84f6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/gov.md +++ b/windows/security/threat-protection/microsoft-defender-atp/gov.md @@ -126,4 +126,4 @@ Integrations: Microsoft Endpoint DLP | ![No](../images/svg/check-no.svg) On engi Integrations: Microsoft Intune | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development Integrations: Microsoft Power Automate & Azure Logic Apps | ![No](../images/svg/check-no.svg) Rolling out | ![No](../images/svg/check-no.svg) In development Integrations: Skype for Business / Teams | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development -Microsoft Threat Experts | ![No](../images/svg/check-no.svg) | ![No](../images/svg/check-no.svg) +Microsoft Threat Experts | ![No](../images/svg/check-no.svg) In development | ![No](../images/svg/check-no.svg) In development From c8969b6e4f8fc3b2357972e7ba054c4bbfd52792 Mon Sep 17 00:00:00 2001 From: adirdidi <68847945+adirdidi@users.noreply.github.com> Date: Thu, 7 Jan 2021 22:13:52 +0200 Subject: [PATCH 136/206] Update gov.md --- .../security/threat-protection/microsoft-defender-atp/gov.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/gov.md b/windows/security/threat-protection/microsoft-defender-atp/gov.md index a8904d84f6..9f89eda253 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/gov.md +++ b/windows/security/threat-protection/microsoft-defender-atp/gov.md @@ -126,4 +126,4 @@ Integrations: Microsoft Endpoint DLP | ![No](../images/svg/check-no.svg) On engi Integrations: Microsoft Intune | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development Integrations: Microsoft Power Automate & Azure Logic Apps | ![No](../images/svg/check-no.svg) Rolling out | ![No](../images/svg/check-no.svg) In development Integrations: Skype for Business / Teams | ![Yes](../images/svg/check-yes.svg) | ![No](../images/svg/check-no.svg) In development -Microsoft Threat Experts | ![No](../images/svg/check-no.svg) In development | ![No](../images/svg/check-no.svg) In development +Microsoft Threat Experts | ![No](../images/svg/check-no.svg) On engineering backlog | ![No](../images/svg/check-no.svg) On engineering backlog From 7953f7477d523a50d9cf944001e95b7dfe93c407 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 7 Jan 2021 14:41:29 -0800 Subject: [PATCH 137/206] Update edr-in-block-mode.md --- .../microsoft-defender-atp/edr-in-block-mode.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md index 8f97a4b56f..640feefc2f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md +++ b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md @@ -91,7 +91,7 @@ EDR in block mode does not affect third-party antivirus protection running on us ### Why do I need to keep Microsoft Defender Antivirus up to date? -Because Microsoft Defender Antivirus detects and remediates malicious items, it's important to keep it up to date to use the latest device learning models, behavioral detections, and heuristics for EDR in block mode to be most effective. The [Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection) stack of capabilities works in an integrated manner, and to get best protection value, you should keep Microsoft Defender Antivirus up to date. +Because Microsoft Defender Antivirus detects and remediates malicious items, it's important to keep it up to date. For EDR in block mode to be effective, it uses the latest device learning models, behavioral detections, and heuristics. The [Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection) stack of capabilities works in an integrated manner. To get best protection value, you should keep Microsoft Defender Antivirus up to date. ### Why do we need cloud protection on? @@ -111,7 +111,7 @@ To confirm whether Microsoft Defender Antivirus is running in active or passive 2. Type `Get-MpComputerStatus`. -3. In the list of results, in the `AMRunningMode` row, look for one of the following values: +3. In the list of results, in the **AMRunningMode** row, look for one of the following values: - `Normal` - `Passive Mode` - `SxS Passive Mode` @@ -124,7 +124,7 @@ To learn more, see [Get-MpComputerStatus](https://docs.microsoft.com/powershell/ 2. Type `sc query windefend`. -3. In the list of results, in the `STATE` row, confirm that the service is running. +3. In the list of results, in the **STATE** row, confirm that the service is running. ## See also From 6dd2bf3e0ed3102e1c2750d31c5688b85354f2db Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 7 Jan 2021 14:47:56 -0800 Subject: [PATCH 138/206] Update prevent-changes-to-security-settings-with-tamper-protection.md --- ...ecurity-settings-with-tamper-protection.md | 24 +++++++++++-------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md b/windows/security/threat-protection/microsoft-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md index 567fc845b6..02e271f7a0 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md @@ -14,7 +14,7 @@ audience: ITPro author: denisebmsft ms.author: deniseb ms.custom: nextgen -ms.date: 11/19/2020 +ms.date: 01/07/2021 --- # Protect security settings with tamper protection @@ -24,8 +24,12 @@ ms.date: 11/19/2020 **Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +Tamper protection is available on devices running the following versions of Windows: + - Windows 10 -- Windows Server 2019 (if using tenant attach with [Configuration Manager, version 2006](#manage-tamper-protection-with-configuration-manager-version-2006)) +- Windows Server 2016 and 2019 (if using tenant attach with [Configuration Manager, version 2006](#manage-tamper-protection-with-configuration-manager-version-2006)) ## Overview @@ -74,7 +78,7 @@ Tamper protection doesn't prevent you from viewing your security settings. And, If you are a home user, or you are not subject to settings managed by a security team, you can use the Windows Security app to turn tamper protection on or off. You must have appropriate admin permissions on your machine to do change security settings, such as tamper protection. -1. Click **Start**, and start typing *Defender*. In the search results, select **Windows Security**. +1. Click **Start**, and start typing *Security*. In the search results, select **Windows Security**. 2. Select **Virus & threat protection** > **Virus & threat protection settings**. @@ -101,15 +105,15 @@ You must have appropriate [permissions](../microsoft-defender-atp/assign-portal- 3. Select **Devices** > **Configuration Profiles**. -4. Create a profile as follows: +4. Create a profile that includes the following settings: - - Platform: **Windows 10 and later** + - **Platform: Windows 10 and later** - - Profile type: **Endpoint protection** + - **Profile type: Endpoint protection** - - Category: **Microsoft Defender Security Center** + - **Category: Microsoft Defender Security Center** - - Tamper Protection: **Enabled** + - **Tamper Protection: Enabled** ![Turn tamper protection on with Intune](images/turnontamperprotect-MEM.png) @@ -132,7 +136,7 @@ If you are using Windows 10 OS [1709](https://docs.microsoft.com/windows/release > [!IMPORTANT] > The procedure can be used to extend tamper protection to devices running Windows 10 and Windows Server 2019. Make sure to review the prerequisites and other information in the resources mentioned in this procedure. -If you're using [version 2006 of Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/plan-design/changes/whats-new-in-version-2006), you can manage tamper protection settings on Windows 10 and Windows Server 2019 by using a method called *tenant attach*. Tenant attach enables you to sync your on-premises-only Configuration Manager devices into the Microsoft Endpoint Manager admin center, and then deliver your endpoint security configuration policies to your on-premises collections & devices. +If you're using [version 2006 of Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/plan-design/changes/whats-new-in-version-2006), you can manage tamper protection settings on Windows 10, Windows Server 2016, and Windows Server 2019 by using a method called *tenant attach*. Tenant attach enables you to sync your on-premises-only Configuration Manager devices into the Microsoft Endpoint Manager admin center, and then deliver your endpoint security configuration policies to your on-premises collections & devices. 1. Set up tenant attach. See [Microsoft Endpoint Manager tenant attach: Device sync and device actions](https://docs.microsoft.com/mem/configmgr/tenant-attach/device-sync-actions). @@ -209,7 +213,7 @@ Your regular group policy doesn’t apply to tamper protection, and changes to M ### For Microsoft Defender for Endpoint, is configuring tamper protection in Intune targeted to the entire organization only? -Configuring tamper protection in Intune or Microsoft Endpoint Manager can be targeted to your entire organization as well as to specific devices and user groups. +Configuring tamper protection in Intune or Microsoft Endpoint Manager can be targeted to your entire organization and to specific devices and user groups. ### Can I configure Tamper Protection in Microsoft Endpoint Configuration Manager? From b4ee3e3c0eb2f87a273b57c0b3c688ff389997b9 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 7 Jan 2021 14:49:33 -0800 Subject: [PATCH 139/206] Update prevent-changes-to-security-settings-with-tamper-protection.md --- ...event-changes-to-security-settings-with-tamper-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md b/windows/security/threat-protection/microsoft-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md index 02e271f7a0..ad05cd6b37 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md @@ -94,7 +94,7 @@ If you are part of your organization's security team, and your subscription incl You must have appropriate [permissions](../microsoft-defender-atp/assign-portal-access.md), such as global admin, security admin, or security operations, to perform the following task. -1. Make sure your organization meets all of the following requirements to manage tamper protection using Intune: +1. Make sure your organization meets all of the following requirements to use Intune to manage tamper protection: - Your organization uses [Intune to manage devices](https://docs.microsoft.com/intune/fundamentals/what-is-device-management). ([Intune licenses](https://docs.microsoft.com/intune/fundamentals/licenses) are required; Intune is included in Microsoft 365 E5.) - Your Windows machines must be running Windows 10 OS [1709](https://docs.microsoft.com/windows/release-information/status-windows-10-1709), [1803](https://docs.microsoft.com/windows/release-information/status-windows-10-1803), [1809](https://docs.microsoft.com/windows/release-information/status-windows-10-1809-and-windows-server-2019) or later. (For more information about releases, see [Windows 10 release information](https://docs.microsoft.com/windows/release-information/).) From 5d6b341c0bb2e780ab14f67652d6ba00b0f9ca64 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 7 Jan 2021 14:51:48 -0800 Subject: [PATCH 140/206] Update edr-in-block-mode.md --- .../microsoft-defender-atp/edr-in-block-mode.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md index 640feefc2f..0c01e2faf7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md +++ b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md @@ -73,8 +73,8 @@ The following image shows an instance of unwanted software that was detected and |Windows E5 enrollment |Windows E5 is included in the following subscriptions:
    - Microsoft 365 E5
    - Microsoft 365 E3 together with the Identity & Threat Protection offering

    See [Components](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview?view=o365-worldwide&preserve-view=true#components) and [features and capabilities for each plan](https://www.microsoft.com/microsoft-365/compare-all-microsoft-365-plans). | |Microsoft Defender Antivirus |Microsoft Defender Antivirus must be installed and running in either active mode or passive mode. (You can use Microsoft Defender Antivirus alongside a non-Microsoft antivirus solution.) [Confirm Microsoft Defender Antivirus is in active or passive mode](#how-do-i-confirm-microsoft-defender-antivirus-is-in-active-or-passive-mode). | |Cloud-delivered protection |Make sure Microsoft Defender Antivirus is configured such that [cloud-delivered protection is enabled](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus). | -|Microsoft Defender Antivirus antimalware client |Make sure your client is up to date. Using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps&preserve-view=true) cmdlet as an administrator.
    In the **AMProductVersion** line, you should see **4.18.2001.10** or above. | -|Microsoft Defender Antivirus engine |Make sure your engine is up to date. Using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps&preserve-view=true) cmdlet as an administrator.
    In the **AMEngineVersion** line, you should see **1.1.16700.2** or above. | +|Microsoft Defender Antivirus antimalware client |Make sure your client is up to date. Using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps&preserve-view=true) cmdlet as an administrator. In the **AMProductVersion** line, you should see **4.18.2001.10** or above. | +|Microsoft Defender Antivirus engine |Make sure your engine is up to date. Using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps&preserve-view=true) cmdlet as an administrator. In the **AMEngineVersion** line, you should see **1.1.16700.2** or above. | > [!IMPORTANT] > To get the best protection value, make sure your antivirus solution is configured to receive regular updates and essential features, and that your [exclusions are configured](../microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md). EDR in block mode respects exclusions that are defined for Microsoft Defender Antivirus. From 3dba1bbb77367ad88111e6c6043b8afcc49adaa9 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 7 Jan 2021 14:58:56 -0800 Subject: [PATCH 141/206] fixing applies to --- ...igure-block-at-first-sight-microsoft-defender-antivirus.md | 2 +- ...cloud-block-timeout-period-microsoft-defender-antivirus.md | 2 +- ...figure-network-connections-microsoft-defender-antivirus.md | 2 +- ...onfigure-server-exclusions-microsoft-defender-antivirus.md | 4 ++++ 4 files changed, 7 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md index 43aa53b445..c3ec759d81 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md @@ -22,7 +22,7 @@ ms.date: 10/22/2020 **Applies to:** -- Microsoft Defender Antivirus +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) Block at first sight provides a way to detect and block new malware within seconds. This protection is enabled by default when certain prerequisite settings are enabled. These settings include cloud-delivered protection, a specified sample submission timeout (such as 50 seconds), and a file-blocking level of high. In most enterprise organizations, these settings are enabled by default with Microsoft Defender Antivirus deployments. diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus.md index 4be673460a..2555377694 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus.md @@ -23,7 +23,7 @@ manager: dansimp **Applies to:** -- Microsoft Defender Antivirus +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) When Microsoft Defender Antivirus finds a suspicious file, it can prevent the file from running while it queries the [Microsoft Defender Antivirus cloud service](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md). diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus.md index 1485e83d0a..e4896f9709 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus.md @@ -23,7 +23,7 @@ manager: dansimp **Applies to:** -- Microsoft Defender Antivirus +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) To ensure Microsoft Defender Antivirus cloud-delivered protection works properly, you need to configure your network to allow connections between your endpoints and certain Microsoft servers. diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md index 1fa6c1665b..7c834bd8e4 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md @@ -19,6 +19,10 @@ ms.custom: nextgen [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + Microsoft Defender Antivirus on Windows Server 2016 and 2019 automatically enrolls you in certain exclusions, as defined by your specified server role. See the [list of automatic exclusions](#list-of-automatic-exclusions) (in this article). These exclusions do not appear in the standard exclusion lists that are shown in the [Windows Security app](microsoft-defender-security-center-antivirus.md#exclusions). From d6bf4b4138ecceaf7681002939deb5b2877ea4d0 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 7 Jan 2021 15:02:00 -0800 Subject: [PATCH 142/206] fixing applies to --- .../enable-cloud-protection-microsoft-defender-antivirus.md | 2 +- .../office-365-microsoft-defender-antivirus.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md index 2dfddb6de2..69956ae919 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md @@ -21,7 +21,7 @@ ms.custom: nextgen **Applies to:** -- Microsoft Defender Antivirus +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) > [!NOTE] > The Microsoft Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud; rather, it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional Security intelligence updates. diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/office-365-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/office-365-microsoft-defender-antivirus.md index eb9a31fb16..3ca4e0239b 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/office-365-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/office-365-microsoft-defender-antivirus.md @@ -24,9 +24,9 @@ manager: dansimp **Applies to:** - +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) - Microsoft Defender Antivirus -- Office 365 +- Microsoft 365 You might already know that: From 25d41dd409ac343ca06c27d94e8a888a95691867 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 7 Jan 2021 15:02:37 -0800 Subject: [PATCH 143/206] Update specify-cloud-protection-level-microsoft-defender-antivirus.md --- ...ecify-cloud-protection-level-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md index 433c59bb6f..79cb4f70cc 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md @@ -23,7 +23,7 @@ ms.custom: nextgen **Applies to:** -- Microsoft Defender Antivirus +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) You can specify your level of cloud-delivered protection offered by Microsoft Defender Antivirus by using Microsoft Endpoint Manager (recommended) or Group Policy. From 92028eaf0c6845828c9a60a013570fde6b1ba9b6 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 7 Jan 2021 15:02:45 -0800 Subject: [PATCH 144/206] Acrolinx: "Mac OS" --- .../security/threat-protection/microsoft-defender-atp/gov.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/gov.md b/windows/security/threat-protection/microsoft-defender-atp/gov.md index 9f89eda253..2942c525e6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/gov.md +++ b/windows/security/threat-protection/microsoft-defender-atp/gov.md @@ -57,7 +57,7 @@ Windows 8 Pro | ![No](../images/svg/check-no.svg) Rolling out | ![No](../images/ Windows 7 SP1 Enterprise | ![No](../images/svg/check-no.svg) Rolling out | ![No](../images/svg/check-no.svg) In development Windows 7 SP1 Pro | ![No](../images/svg/check-no.svg) Rolling out | ![No](../images/svg/check-no.svg) In development Linux | ![No](../images/svg/check-no.svg) In development | ![No](../images/svg/check-no.svg) In development -Mac OS | ![No](../images/svg/check-no.svg) In development | ![No](../images/svg/check-no.svg) In development +macOS | ![No](../images/svg/check-no.svg) In development | ![No](../images/svg/check-no.svg) In development Android | ![No](../images/svg/check-no.svg) On engineering backlog | ![No](../images/svg/check-no.svg) On engineering backlog iOS | ![No](../images/svg/check-no.svg) On engineering backlog | ![No](../images/svg/check-no.svg) On engineering backlog From ea93ea5f97bada546a57ad649b80bfa2b1c7347e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 7 Jan 2021 15:03:07 -0800 Subject: [PATCH 145/206] Update utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md --- ...e-microsoft-cloud-protection-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md index da103c7192..b0a598436f 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md @@ -21,7 +21,7 @@ ms.custom: nextgen **Applies to:** -- Microsoft Defender Antivirus +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) Microsoft next-generation technologies in Microsoft Defender Antivirus provide near-instant, automated protection against new and emerging threats. To dynamically identify new threats, these technologies work with large sets of interconnected data in the Microsoft Intelligent Security Graph and powerful artificial intelligence (AI) systems driven by advanced machine learning models. From 1d2dcd86fa81c9e180615e1233a5ddb222ebda77 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 7 Jan 2021 15:28:08 -0800 Subject: [PATCH 146/206] Update manage-updates-baselines-microsoft-defender-antivirus.md --- ...tes-baselines-microsoft-defender-antivirus.md | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index 1b9cc2aad0..cd30c7318d 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -13,7 +13,7 @@ ms.author: deniseb ms.custom: nextgen ms.reviewer: pahuijbr manager: dansimp -ms.date: 01/06/2021 +ms.date: 01/07/2021 --- # Manage Microsoft Defender Antivirus updates and apply baselines @@ -387,6 +387,20 @@ We recommend updating your Windows 10 (Enterprise, Pro, and Home editions), Wind For more information, see [Microsoft Defender update for Windows operating system installation images](https://support.microsoft.com/help/4568292/defender-update-for-windows-operating-system-installation-images).
    +1.1.2101.02 + + Package version: **1.1.2101.02** + Platform version: **4.18.2011.6** + Engine version: **1.17700.4** + Signature version: **1.329.1796.0** + +### Fixes +- None + +### Additional information +- None +
    +
    1.1.2012.01  Package version: **1.1.2012.01** From 382f6671f37e1b372ddf193b163026e6cfe81d52 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 7 Jan 2021 15:29:02 -0800 Subject: [PATCH 147/206] Update manage-updates-baselines-microsoft-defender-antivirus.md --- .../manage-updates-baselines-microsoft-defender-antivirus.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index cd30c7318d..b0d94c4785 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -355,7 +355,6 @@ When this update is installed, the device needs the jump package 4.10.2001.10 to ## Microsoft Defender Antivirus platform support Platform and engine updates are provided on a monthly cadence. To be fully supported, keep current with the latest platform updates. Our support structure is dynamic, evolving into two phases depending on the availability of the latest platform version: - - **Security and Critical Updates servicing phase** - When running the latest platform version, you will be eligible to receive both Security and Critical updates to the anti-malware platform. - **Technical Support (Only) phase** - After a new platform version is released, support for older versions (N-2) will reduce to technical support only. Platform versions older than N-2 will no longer be supported.* From 1dc25a2dc52b8d2d932ad3a83b8cd97d06a739c0 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 7 Jan 2021 15:51:47 -0800 Subject: [PATCH 148/206] add link to onboarding video --- .../microsoft-defender-atp/onboarding.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboarding.md b/windows/security/threat-protection/microsoft-defender-atp/onboarding.md index 5cbe6e5c30..bdcafd18a1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboarding.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboarding.md @@ -43,6 +43,15 @@ These are the steps you need to take to deploy Defender for Endpoint: ## Step 1: Onboard endpoints using any of the supported management tools The [Plan deployment](deployment-strategy.md) topic outlines the general steps you need to take to deploy Defender for Endpoint. + +Watch this video for a quick overview of the onboarding process and learn about the available tools and methods. +
    +
    + +> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4bGqr] + + + After identifying your architecture, you'll need to decide which deployment method to use. The deployment tool you choose influences how you onboard endpoints to the service. ### Onboarding tool options From 6c9cf28542a96b25c59d2d1571ff7371553ac46d Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Fri, 8 Jan 2021 01:27:31 +0100 Subject: [PATCH 149/206] Update enable-exploit-protection.md From issue ticket #8927 (**No such property as TerminateOnHeapError**): > In the list of properties used for different security exploit settings for the cmdlets, the properties to be set for 'Validate heap integrity' is labeled wrong. > > | Validate heap integrity | System and app-level | TerminateOnHeapError | Audit not available | > > **The property 'TerminateOnHeapError' doesn't exist for Heap. It should be TerminateOnError.** Thanks to dennisl68-castra for noticing and reporting this incorrect term variant. Changes proposed: - Change "TerminateOnHeapError" to 'TerminateOnError' Whitespace changes: - Add recommended minimum cell divider spacing to the MarkDown table cells - Align table dividing row cell dividers with the table title row cell dividers - Add editorial line between footnote mark [2] and second last H2 (##) heading Closes #8927 Ref. old PR #4351 from July 5, 2019 (before Windows Defender Exploit Guard was changed or retired) --- .../enable-exploit-protection.md | 53 ++++++++++--------- 1 file changed, 27 insertions(+), 26 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md index 7b1c044a64..cb9f2e13d1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md @@ -54,8 +54,8 @@ You can also set mitigations to [audit mode](evaluate-exploit-protection.md). Au 3. Go to **Program settings** and choose the app you want to apply mitigations to.
    - If the app you want to configure is already listed, click it and then click **Edit**. - If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app.
    - - Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location. - - Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want. + - Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location. + - Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want. 4. After selecting the app, you'll see a list of all the mitigations that can be applied. Choosing **Audit** will apply the mitigation in audit mode only. You are notified if you need to restart the process or app, or if you need to restart Windows. @@ -114,7 +114,7 @@ The result will be that DEP will be enabled for *test.exe*. DEP will not be enab 3. Name the profile, choose **Windows 10 and later** and **Endpoint protection**.
    ![Create endpoint protection profile](../images/create-endpoint-protection-profile.png)
    -4. Click **Configure** > **Windows Defender Exploit Guard** > **Exploit protection**. +4. Click **Configure** > **Windows Defender Exploit Guard** > **Exploit protection**. 5. Upload an [XML file](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-exploitguard) with the exploit protection settings:
    ![Enable network protection in Intune](../images/enable-ep-intune.png)
    @@ -209,29 +209,29 @@ Set-Processmitigation -Name test.exe -Remove -Disable DEP This table lists the PowerShell cmdlets (and associated audit mode cmdlet) that can be used to configure each mitigation. -|Mitigation | Applies to | PowerShell cmdlets | Audit mode cmdlet | -|:---|:---|:---|:---| -|Control flow guard (CFG) | System and app-level | CFG, StrictCFG, SuppressExports | Audit not available | -|Data Execution Prevention (DEP) | System and app-level | DEP, EmulateAtlThunks | Audit not available | -|Force randomization for images (Mandatory ASLR) | System and app-level | ForceRelocateImages | Audit not available | -|Randomize memory allocations (Bottom-Up ASLR) | System and app-level | BottomUp, HighEntropy | Audit not available -|Validate exception chains (SEHOP) | System and app-level | SEHOP, SEHOPTelemetry | Audit not available -|Validate heap integrity | System and app-level | TerminateOnHeapError | Audit not available -|Arbitrary code guard (ACG) | App-level only | DynamicCode | AuditDynamicCode -|Block low integrity images | App-level only | BlockLowLabel | AuditImageLoad -|Block remote images | App-level only | BlockRemoteImages | Audit not available -|Block untrusted fonts | App-level only | DisableNonSystemFonts | AuditFont, FontAuditOnly -|Code integrity guard | App-level only | BlockNonMicrosoftSigned, AllowStoreSigned | AuditMicrosoftSigned, AuditStoreSigned -|Disable extension points | App-level only | ExtensionPoint | Audit not available -|Disable Win32k system calls | App-level only | DisableWin32kSystemCalls | AuditSystemCall -|Do not allow child processes | App-level only | DisallowChildProcessCreation | AuditChildProcess -|Export address filtering (EAF) | App-level only | EnableExportAddressFilterPlus, EnableExportAddressFilter     \[1\] | Audit not available\[2\] | -|Import address filtering (IAF) | App-level only | EnableImportAddressFilter | Audit not available\[2\] | -|Simulate execution (SimExec) | App-level only | EnableRopSimExec | Audit not available\[2\] | -|Validate API invocation (CallerCheck) | App-level only | EnableRopCallerCheck | Audit not available\[2\] | -|Validate handle usage | App-level only | StrictHandle | Audit not available | -|Validate image dependency integrity | App-level only | EnforceModuleDepencySigning | Audit not available | -|Validate stack integrity (StackPivot) | App-level only | EnableRopStackPivot | Audit not available\[2\] | +| Mitigation | Applies to | PowerShell cmdlets | Audit mode cmdlet | +| :--------- | :--------- | :----------------- | :---------------- | +| Control flow guard (CFG) | System and app-level | CFG, StrictCFG, SuppressExports | Audit not available | +| Data Execution Prevention (DEP) | System and app-level | DEP, EmulateAtlThunks | Audit not available | +| Force randomization for images (Mandatory ASLR) | System and app-level | ForceRelocateImages | Audit not available | +| Randomize memory allocations (Bottom-Up ASLR) | System and app-level | BottomUp, HighEntropy | Audit not available +| Validate exception chains (SEHOP) | System and app-level | SEHOP, SEHOPTelemetry | Audit not available | +| Validate heap integrity | System and app-level | TerminateOnError | Audit not available | +| Arbitrary code guard (ACG) | App-level only | DynamicCode | AuditDynamicCode | +| Block low integrity images | App-level only | BlockLowLabel | AuditImageLoad | +| Block remote images | App-level only | BlockRemoteImages | Audit not available | +| Block untrusted fonts | App-level only | DisableNonSystemFonts | AuditFont, FontAuditOnly | +| Code integrity guard | App-level only | BlockNonMicrosoftSigned, AllowStoreSigned | AuditMicrosoftSigned, AuditStoreSigned | +| Disable extension points | App-level only | ExtensionPoint | Audit not available | +| Disable Win32k system calls | App-level only | DisableWin32kSystemCalls | AuditSystemCall | +| Do not allow child processes | App-level only | DisallowChildProcessCreation | AuditChildProcess | +| Export address filtering (EAF) | App-level only | EnableExportAddressFilterPlus, EnableExportAddressFilter \[1\] | Audit not available\[2\] | +| Import address filtering (IAF) | App-level only | EnableImportAddressFilter | Audit not available\[2\] | +| Simulate execution (SimExec) | App-level only | EnableRopSimExec | Audit not available\[2\] | +| Validate API invocation (CallerCheck) | App-level only | EnableRopCallerCheck | Audit not available\[2\] | +| Validate handle usage | App-level only | StrictHandle | Audit not available | +| Validate image dependency integrity | App-level only | EnforceModuleDepencySigning | Audit not available | +| Validate stack integrity (StackPivot) | App-level only | EnableRopStackPivot | Audit not available\[2\] | \[1\]: Use the following format to enable EAF modules for DLLs for a process: @@ -239,6 +239,7 @@ This table lists the PowerShell cmdlets (and associated audit mode cmdlet) that Set-ProcessMitigation -Name processName.exe -Enable EnableExportAddressFilterPlus -EAFModules dllName1.dll,dllName2.dll ``` \[2\]: Audit for this mitigation is not available via Powershell cmdlets. + ## Customize the notification See the [Windows Security](../windows-defender-security-center/windows-defender-security-center.md#customize-notifications-from-the-windows-defender-security-center) topic for more information about customizing the notification when a rule is triggered and blocks an app or file. From 22a2aaed3a53254cad33114b48768ac2a43003f3 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Fri, 8 Jan 2021 01:59:20 +0100 Subject: [PATCH 150/206] Ticket #8926 (Table of PowerShell cmdlets isn't) > "This table lists the PowerShell cmdlets" doesn't list the cmdlets (there are only three). > The column marked PowerShell cmdlets seems to refer to property names. Current table description text: "This table lists the PowerShell cmdlets (and associated audit mode cmdlet) that can be used to configure each mitigation." **Suggested description:** This table lists the individual **Mitigations** (and **Audits**, when available) to be used with the `-Enable` or `-Disable` cmdlet parameters. Closes #8926 --- .../microsoft-defender-atp/enable-exploit-protection.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md index cb9f2e13d1..8fe52a9432 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md @@ -207,10 +207,10 @@ If you need to restore the mitigation back to the system default, you need to in Set-Processmitigation -Name test.exe -Remove -Disable DEP ``` -This table lists the PowerShell cmdlets (and associated audit mode cmdlet) that can be used to configure each mitigation. +This table lists the individual **Mitigations** (and **Audits**, when available) to be used with the `-Enable` or `-Disable` cmdlet parameters. -| Mitigation | Applies to | PowerShell cmdlets | Audit mode cmdlet | -| :--------- | :--------- | :----------------- | :---------------- | +| Mitigation type | Applies to | Mitigation cmdlet parameter keyword | Audit mode cmdlet parameter | +| :-------------- | :--------- | :---------------------------------- | :-------------------------- | | Control flow guard (CFG) | System and app-level | CFG, StrictCFG, SuppressExports | Audit not available | | Data Execution Prevention (DEP) | System and app-level | DEP, EmulateAtlThunks | Audit not available | | Force randomization for images (Mandatory ASLR) | System and app-level | ForceRelocateImages | Audit not available | From a6b6fb7504436fdb26503baadf99034da0e358de Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 8 Jan 2021 07:15:27 +0530 Subject: [PATCH 151/206] added admx templates link for windows 10 20h2 as per user report #8922 , so i added admx templates link for windows 10 20h2 --- ...unwanted-apps-microsoft-defender-antivirus.md | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md index cb05c08abe..73b0e26503 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md @@ -110,19 +110,21 @@ For System Center 2012 Configuration Manager, see [How to Deploy Potentially Unw #### Use Group Policy to configure PUA protection -1. On your Group Policy management computer, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure, and select **Edit**. +1. First download and install [Administrative Templates (.admx) for Windows 10 October 2020 Update (20H2)](https://www.microsoft.com/download/details.aspx?id=102157) -2. In the **Group Policy Management Editor**, go to **Computer configuration** and select **Administrative templates**. +2. On your Group Policy management computer, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure, and select **Edit**. -3. Expand the tree to **Windows Components** > **Microsoft Defender Antivirus**. +3. In the **Group Policy Management Editor**, go to **Computer configuration** and select **Administrative templates**. -4. Double-click **Configure detection for potentially unwanted applications**. +4. Expand the tree to **Windows Components** > **Microsoft Defender Antivirus**. -5. Select **Enabled** to enable PUA protection. +5. Double-click **Configure detection for potentially unwanted applications**. -6. In **Options**, select **Block** to block potentially unwanted applications, or select **Audit Mode** to test how the setting will work in your environment. Select **OK**. +6. Select **Enabled** to enable PUA protection. -7. Deploy your Group Policy object as you usually do. +7. In **Options**, select **Block** to block potentially unwanted applications, or select **Audit Mode** to test how the setting will work in your environment. Select **OK**. + +8. Deploy your Group Policy object as you usually do. #### Use PowerShell cmdlets to configure PUA protection From 1bac573680eca1f8f8856b85e0aedb5eb942a1b8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 8 Jan 2021 09:39:32 -0800 Subject: [PATCH 152/206] Update detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md --- ...ck-potentially-unwanted-apps-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md index 73b0e26503..2e9a3babb4 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md @@ -11,7 +11,7 @@ author: denisebmsft ms.author: deniseb ms.custom: nextgen audience: ITPro -ms.date: 11/30/2020 +ms.date: 01/08/2021 ms.reviewer: manager: dansimp --- From 9841d91419757ca722fdd55cdb356b6d9c91384f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 8 Jan 2021 09:41:20 -0800 Subject: [PATCH 153/206] Update detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md --- ...wanted-apps-microsoft-defender-antivirus.md | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md index 2e9a3babb4..9be1ca37a3 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md @@ -110,21 +110,23 @@ For System Center 2012 Configuration Manager, see [How to Deploy Potentially Unw #### Use Group Policy to configure PUA protection -1. First download and install [Administrative Templates (.admx) for Windows 10 October 2020 Update (20H2)](https://www.microsoft.com/download/details.aspx?id=102157) +1. Download and install [Administrative Templates (.admx) for Windows 10 October 2020 Update (20H2)](https://www.microsoft.com/download/details.aspx?id=102157) -2. On your Group Policy management computer, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure, and select **Edit**. +2. On your Group Policy management computer, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)). -3. In the **Group Policy Management Editor**, go to **Computer configuration** and select **Administrative templates**. +3. Select the Group Policy Object you want to configure, and then choose **Edit**. -4. Expand the tree to **Windows Components** > **Microsoft Defender Antivirus**. +4. In the **Group Policy Management Editor**, go to **Computer configuration** and select **Administrative templates**. -5. Double-click **Configure detection for potentially unwanted applications**. +5. Expand the tree to **Windows Components** > **Microsoft Defender Antivirus**. -6. Select **Enabled** to enable PUA protection. +6. Double-click **Configure detection for potentially unwanted applications**. -7. In **Options**, select **Block** to block potentially unwanted applications, or select **Audit Mode** to test how the setting will work in your environment. Select **OK**. +7. Select **Enabled** to enable PUA protection. -8. Deploy your Group Policy object as you usually do. +8. In **Options**, select **Block** to block potentially unwanted applications, or select **Audit Mode** to test how the setting will work in your environment. Select **OK**. + +9. Deploy your Group Policy object as you usually do. #### Use PowerShell cmdlets to configure PUA protection From 2e7e01b0ae18ed40d1c6b0a5506e51e258197957 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 8 Jan 2021 09:43:28 -0800 Subject: [PATCH 154/206] Update enable-exploit-protection.md --- .../microsoft-defender-atp/enable-exploit-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md index 8fe52a9432..6af9be7d68 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md @@ -47,7 +47,7 @@ You can also set mitigations to [audit mode](evaluate-exploit-protection.md). Au ## Windows Security app -1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. +1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Security**. 2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then click **Exploit protection settings**. From f556d65b446200c395df9087b5e3a12645fb3513 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 8 Jan 2021 09:46:11 -0800 Subject: [PATCH 155/206] Update enable-exploit-protection.md --- .../enable-exploit-protection.md | 22 ++++++++----------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md index 6af9be7d68..c015175767 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md @@ -30,14 +30,13 @@ manager: dansimp Many features from the Enhanced Mitigation Experience Toolkit (EMET) are included in exploit protection. -You can enable each mitigation separately by using any of these methods: - -* [Windows Security app](#windows-security-app) -* [Microsoft Intune](#intune) -* [Mobile Device Management (MDM)](#mdm) -* [Microsoft Endpoint Configuration Manager](#microsoft-endpoint-configuration-manager) -* [Group Policy](#group-policy) -* [PowerShell](#powershell) +You can enable each mitigation separately by using any of these methods: +- [Windows Security app](#windows-security-app) +- [Microsoft Intune](#intune) +- [Mobile Device Management (MDM)](#mdm) +- [Microsoft Endpoint Configuration Manager](#microsoft-endpoint-configuration-manager) +- [Group Policy](#group-policy) +- [PowerShell](#powershell) Exploit protection is configured by default in Windows 10. You can set each mitigation to on, off, or to its default value. Some mitigations have additional options. @@ -160,11 +159,8 @@ Get-ProcessMitigation -Name processName.exe > [!IMPORTANT] > System-level mitigations that have not been configured will show a status of `NOTSET`. -> -> For system-level settings, `NOTSET` indicates the default setting for that mitigation has been applied. -> -> For app-level settings, `NOTSET` indicates the system-level setting for the mitigation will be applied. -> +> - For system-level settings, `NOTSET` indicates the default setting for that mitigation has been applied. +> - For app-level settings, `NOTSET` indicates the system-level setting for the mitigation will be applied. > The default setting for each system-level mitigation can be seen in the Windows Security. Use `Set` to configure each mitigation in the following format: From e1b5c852b3ad22d351b96c9be83f1a63278f8e0c Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Fri, 8 Jan 2021 09:59:09 -0800 Subject: [PATCH 156/206] added file name extension lines 66 74 131 --- windows/privacy/manage-windows-20H2-endpoints.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/privacy/manage-windows-20H2-endpoints.md b/windows/privacy/manage-windows-20H2-endpoints.md index 57c2ce989d..d449b47b4c 100644 --- a/windows/privacy/manage-windows-20H2-endpoints.md +++ b/windows/privacy/manage-windows-20H2-endpoints.md @@ -63,7 +63,7 @@ The following methodology was used to derive these network endpoints: |||HTTPS|s-ring.msedge.net| |Device authentication|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| ||The following endpoint is used to authenticate a device. If you turn off traffic for this endpoint, the device will not be authenticated.|HTTPS|login.live.com*| -|Device metadata|The following endpoint is used to retrieve device metadata. If you turn off traffic for this endpoint, metadata will not be updated for the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services#4-device-metadata-retrieval)| +|Device metadata|The following endpoint is used to retrieve device metadata. If you turn off traffic for this endpoint, metadata will not be updated for the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#4-device-metadata-retrieval)| |||HTTP|dmd.metaservices.microsoft.com| |Diagnostic Data|The following endpoints are used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service. If you turn off traffic for this endpoint, diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, will not be sent back to Microsoft. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| |||TLSv1.2/HTTPS/HTTP|v10.events.data.microsoft.com| @@ -71,7 +71,7 @@ The following methodology was used to derive these network endpoints: |||HTTP|www.microsoft.com| ||The following endpoints are used by Windows Error Reporting. To turn off traffic for these endpoints, enable the following Group Policy: Administrative Templates > Windows Components > Windows Error Reporting > Disable Windows Error Reporting. This means error reporting information will not be sent back to Microsoft.|TLSv1.2|telecommand.telemetry.microsoft.com| |||TLS v1.2/HTTPS/HTTP|watson.*.microsoft.com| -|Font Streaming|The following endpoints are used to download fonts on demand. If you turn off traffic for these endpoints, you will not be able to download fonts on demand.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services#6-font-streaming)| +|Font Streaming|The following endpoints are used to download fonts on demand. If you turn off traffic for these endpoints, you will not be able to download fonts on demand.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#6-font-streaming)| |||HTTPS|fs.microsoft.com| |Licensing|The following endpoint is used for online activation and some app licensing. To turn off traffic for this endpoint, disable the Windows License Manager Service. This will also block online activation and app licensing may not work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#9-license-manager)| |||TLSv1.2/HTTPS/HTTP|licensing.mp.microsoft.com| @@ -128,7 +128,7 @@ The following methodology was used to derive these network endpoints: |||TLSv1.2/HTTPS/HTTP|*.update.microsoft.com| ||The following endpoint is used for compatibility database updates for Windows.|HTTPS|adl.windows.com| ||The following endpoint is used for content regulation. If you turn off traffic for this endpoint, the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly downloaded or not downloaded at all.|TLSv1.2/HTTPS/HTTP|tsfe.trafficshaping.dsp.mp.microsoft.com| -|Xbox Live|The following endpoint is used for Xbox Live.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services#26-microsoft-store)| +|Xbox Live|The following endpoint is used for Xbox Live.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| |||HTTPS|dlassets-ssl.xboxlive.com| From 3feb98073f1dd6cb03f646e9f623a95715a0a316 Mon Sep 17 00:00:00 2001 From: Thomas Date: Fri, 8 Jan 2021 10:19:23 -0800 Subject: [PATCH 157/206] Update customize-exploit-protection.md update links --- .../customize-exploit-protection.md | 50 +++++++++---------- 1 file changed, 25 insertions(+), 25 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md index 964158b256..3c72846e6a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md @@ -48,27 +48,27 @@ For the associated PowerShell cmdlets for each mitigation, see the [PowerShell r | Mitigation | Description | Can be applied to | Audit mode available | | ---------- | ----------- | ----------------- | -------------------- | -| Control flow guard (CFG) | Ensures control flow integrity for indirect calls. Can optionally suppress exports and use strict CFG. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] | -| Data Execution Prevention (DEP) | Prevents code from being run from data-only memory pages such as the heap and stacks. Only configurable for 32-bit (x86) apps, permanently enabled for all other architectures. Can optionally enable ATL thunk emulation. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] | -| Force randomization for images (Mandatory ASLR) | Forcibly relocates images not compiled with /DYNAMICBASE. Can optionally fail loading images that don't have relocation information. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] | -| Randomize memory allocations (Bottom-Up ASLR) | Randomizes locations for virtual memory allocations. It includes system structure heaps, stacks, TEBs, and PEBs. Can optionally use a wider randomization variance for 64-bit processes. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] | -| Validate exception chains (SEHOP) | Ensures the integrity of an exception chain during exception dispatch. Only configurable for 32-bit (x86) applications. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] | -| Validate heap integrity | Terminates a process when heap corruption is detected. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] | -| Arbitrary code guard (ACG) | Prevents the introduction of non-image-backed executable code and prevents code pages from being modified. Can optionally allow thread opt-out and allow remote downgrade (configurable only with PowerShell). | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | -| Block low integrity images | Prevents the loading of images marked with Low Integrity. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | -| Block remote images | Prevents loading of images from remote devices. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] | -| Block untrusted fonts | Prevents loading any GDI-based fonts not installed in the system fonts directory, notably fonts from the web. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | -| Code integrity guard | Restricts loading of images signed by Microsoft, WHQL, or higher. Can optionally allow Microsoft Store signed images. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | -| Disable extension points | Disables various extensibility mechanisms that allow DLL injection into all processes, such as AppInit DLLs, window hooks, and Winsock service providers. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] | -| Disable Win32k system calls | Prevents an app from using the Win32k system call table. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | -| Don't allow child processes | Prevents an app from creating child processes. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | -| Export address filtering (EAF) | Detects dangerous operations being resolved by malicious code. Can optionally validate access by modules commonly used by exploits. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | -| Import address filtering (IAF) | Detects dangerous operations being resolved by malicious code. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | -| Simulate execution (SimExec) | Ensures that calls to sensitive APIs return to legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | -| Validate API invocation (CallerCheck) | Ensures that sensitive APIs are invoked by legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | -| Validate handle usage | Causes an exception to be raised on any invalid handle references. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] | -| Validate image dependency integrity | Enforces code signing for Windows image dependency loading. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] | -| Validate stack integrity (StackPivot) | Ensures that the stack hasn't been redirected for sensitive APIs. Not compatible with ACG | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | +| Control flow guard (CFG) | Ensures control flow integrity for indirect calls. Can optionally suppress exports and use strict CFG. | System and app-level | ![Check mark no](../images/svg/check-no.svg) | +| Data Execution Prevention (DEP) | Prevents code from being run from data-only memory pages such as the heap and stacks. Only configurable for 32-bit (x86) apps, permanently enabled for all other architectures. Can optionally enable ATL thunk emulation. | System and app-level | ![Check mark no](../images/svg/check-no.svg) | +| Force randomization for images (Mandatory ASLR) | Forcibly relocates images not compiled with /DYNAMICBASE. Can optionally fail loading images that don't have relocation information. | System and app-level | ![Check mark no](../images/svg/check-no.svg) | +| Randomize memory allocations (Bottom-Up ASLR) | Randomizes locations for virtual memory allocations. It includes system structure heaps, stacks, TEBs, and PEBs. Can optionally use a wider randomization variance for 64-bit processes. | System and app-level | ![Check mark no](../images/svg/check-no.svg) | +| Validate exception chains (SEHOP) | Ensures the integrity of an exception chain during exception dispatch. Only configurable for 32-bit (x86) applications. | System and app-level | ![Check mark no](../images/svg/check-no.svg) | +| Validate heap integrity | Terminates a process when heap corruption is detected. | System and app-level | ![Check mark no](../images/svg/check-no.svg) | +| Arbitrary code guard (ACG) | Prevents the introduction of non-image-backed executable code and prevents code pages from being modified. Can optionally allow thread opt-out and allow remote downgrade (configurable only with PowerShell). | App-level only | ![Check mark yes](../images/svg/check-yes.svg) | +| Block low integrity images | Prevents the loading of images marked with Low Integrity. | App-level only | ![Check mark yes](../images/svg/check-yes.svg)| +| Block remote images | Prevents loading of images from remote devices. | App-level only | ![Check mark no](../images/svg/check-no.svg | +| Block untrusted fonts | Prevents loading any GDI-based fonts not installed in the system fonts directory, notably fonts from the web. | App-level only | !include[Check mark yes](../images/svg/check-yes.svg) | +| Code integrity guard | Restricts loading of images signed by Microsoft, WHQL, or higher. Can optionally allow Microsoft Store signed images. | App-level only | ![Check mark yes](../images/svg/check-yes.svg) | +| Disable extension points | Disables various extensibility mechanisms that allow DLL injection into all processes, such as AppInit DLLs, window hooks, and Winsock service providers. | App-level only | ![Check mark no](../images/svg/check-no.svg) | +| Disable Win32k system calls | Prevents an app from using the Win32k system call table. | App-level only | ![Check mark yes](../images/svg/check-yes.svg) | +| Don't allow child processes | Prevents an app from creating child processes. | App-level only | ![Check mark yes](../images/svg/check-yes.svg) | +| Export address filtering (EAF) | Detects dangerous operations being resolved by malicious code. Can optionally validate access by modules commonly used by exploits. | App-level only | ![Check mark yes](../images/svg/check-yes.svg) | +| Import address filtering (IAF) | Detects dangerous operations being resolved by malicious code. | App-level only | ![Check mark yes](../images/svg/check-yes.svg) | +| Simulate execution (SimExec) | Ensures that calls to sensitive APIs return to legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | ![Check mark yes](../images/svg/check-yes.svg) | +| Validate API invocation (CallerCheck) | Ensures that sensitive APIs are invoked by legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | ![Check mark yes](../images/svg/check-yes.svg) | +| Validate handle usage | Causes an exception to be raised on any invalid handle references. | App-level only | ![Check mark no](../images/svg/check-no.svg) | +| Validate image dependency integrity | Enforces code signing for Windows image dependency loading. | App-level only | ![Check mark no](../images/svg/check-no.svg) | +| Validate stack integrity (StackPivot) | Ensures that the stack hasn't been redirected for sensitive APIs. Not compatible with ACG | App-level only | ![Check mark yes](../images/svg/check-yes.svg) | > [!IMPORTANT] > If you add an app to the **Program settings** section and configure individual mitigation settings there, they will be honored above the configuration for the same mitigations specified in the **System settings** section. The following matrix and examples help to illustrate how defaults work: @@ -76,10 +76,10 @@ For the associated PowerShell cmdlets for each mitigation, see the [PowerShell r > > | Enabled in **Program settings** | Enabled in **System settings** | Behavior | > | ------------------------------- | ------------------------------ | -------- | -> | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] | As defined in **Program settings** | -> | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **Program settings** | -> | [!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **System settings** | -> | [!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | Default as defined in **Use default** option | +> | ![Check mark yes](../images/svg/check-yes.svg) | ![Check mark no](../images/svg/check-no.svg) | As defined in **Program settings** | +> | ![Check mark yes](../images/svg/check-yes.svg) | ![Check mark yes](../images/svg/check-yes.svg) | As defined in **Program settings** | +> | ![Check mark no](../images/svg/check-no.svg) | ![Check mark yes](../images/svg/check-yes.svg) | As defined in **System settings** | +> | ![Check mark no](../images/svg/check-no.svg) | ![Check mark yes](../images/svg/check-yes.svg) | Default as defined in **Use default** option | > > > From ad73f161db7095f445502d8f7bbb1dc1e058b961 Mon Sep 17 00:00:00 2001 From: Thomas Date: Fri, 8 Jan 2021 10:21:55 -0800 Subject: [PATCH 158/206] Update enable-exploit-protection.md update links --- .../microsoft-defender-atp/enable-exploit-protection.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md index c015175767..91a6dc887a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md @@ -71,10 +71,10 @@ If you add an app to the **Program settings** section and configure individual m |Enabled in **Program settings** | Enabled in **System settings** | Behavior | |:---|:---|:---| -|[!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] | As defined in **Program settings** | -|[!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **Program settings** | -|[!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **System settings** | -|[!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | Default as defined in **Use default** option | +|![Check mark yes](../images/svg/check-yes.svg) | ![Check mark no](../images/svg/check-no.svg) | As defined in **Program settings** | +|![Check mark yes](../images/svg/check-yes.svg) | ![Check mark yes](../images/svg/check-yes.svg) | As defined in **Program settings** | +|![Check mark no](../images/svg/check-no.svg) | ![Check mark yes](../images/svg/check-yes.svg) | As defined in **System settings** | +|![Check mark no](../images/svg/check-no.svg) | ![Check mark yes](../images/svg/check-yes.svg) | Default as defined in **Use default** option | ### Example 1: Mikael configures Data Execution Prevention in system settings section to be off by default From da5b55e02a6238dae3042b348ec186ffe45932ad Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 8 Jan 2021 10:36:11 -0800 Subject: [PATCH 159/206] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 6224bb44dc..822248f510 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -14,7 +14,7 @@ ms.author: deniseb ms.reviewer: sugamar, jcedola manager: dansimp ms.custom: asr -ms.date: 12/10/2020 +ms.date: 01/08/2021 --- # Use attack surface reduction rules to prevent malware infection From 34939f9bc55c5f9880bd01b93d3d635137b1508c Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 8 Jan 2021 10:36:45 -0800 Subject: [PATCH 160/206] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 822248f510..bc606abd44 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -468,4 +468,4 @@ GUID: `c1db55ab-c21a-4637-bb3f-a12568109d35` - [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md) -- [Compatibility of Microsoft Defender with other antivirus/antimalware](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md) +- [Compatibility of Microsoft Defender Antivirus with other antivirus/antimalware solutions](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md) From 28fcf74b43190e649ce3140c622765482be83a32 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Sat, 9 Jan 2021 17:33:49 +0100 Subject: [PATCH 161/206] Credential Guard: Windows 10 Enterprise required From issue ticket #8935 (**clarify enterprise sku**): > based on the discussion here #4025, the following confirmation from MSRC 61355 and the resulting PR #8435 - > > could this page also be updated to specifically list "Windows 10 Enterprise" in the requirements list, to avoid confusion from Windows 10 Pro/Home? Thanks to @rrsit for noticing and reporting the lack of clarity in this document. Changes proposed: - State _specifically_ that Credential Guard _supports_ and _requires_ Windows 10 **Enterprise** - Dictionary correction: "writeable" => 'writable' (2 occurrences; the 2017 table Description text, ending Note blob) Closes #8935 --- .../credential-guard/credential-guard-requirements.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md index 2e56e0803c..6768635d8f 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md @@ -20,7 +20,7 @@ ms.reviewer: ## Applies to -- Windows 10 +- Windows 10 Enterprise - Windows Server 2016 For Windows Defender Credential Guard to provide protection, the computers you are protecting must meet certain baseline hardware, firmware, and software requirements, which we will refer to as [Hardware and software requirements](#hardware-and-software-requirements). Additionally, Windows Defender Credential Guard blocks specific authentication capabilities, so applications that require such capabilities will break. We will refer to these requirements as [Application requirements](#application-requirements). Beyond these requirements, computers can meet additional hardware and firmware qualifications, and receive additional protections. Those computers will be more hardened against certain threats. For detailed information on baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, 2016, and 2017, refer to the tables in [Security Considerations](#security-considerations). @@ -135,7 +135,7 @@ The following table lists qualifications for Windows 10, version 1703, which are |Protections for Improved Security|Description|Security Benefits |---|---|---| -|Firmware: **VBS enablement of No-Execute (NX) protection for UEFI runtime services**|**Requirements**:
    - VBS will enable NX protection on UEFI runtime service code and data memory regions. UEFI runtime service code must support read-only page protections, and UEFI runtime service data must not be executable. UEFI runtime service must meet these requirements:
    - Implement UEFI 2.6 EFI_MEMORY_ATTRIBUTES_TABLE. All UEFI runtime service memory (code and data) must be described by this table.
    - PE sections must be page-aligned in memory (not required for in non-volatile storage).
    - The Memory Attributes Table needs to correctly mark code and data as RO/NX for configuration by the OS:
    - All entries must include attributes EFI_MEMORY_RO, EFI_MEMORY_XP, or both.
    - No entries may be left with neither of the above attributes, indicating memory that is both executable and writable. Memory must be either readable and executable or writeable and non-executable.
    (**SEE IMPORTANT INFORMATION AFTER THIS TABLE**)|Vulnerabilities in UEFI runtime, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
    - Reduces the attack surface to VBS from system firmware.| +|Firmware: **VBS enablement of No-Execute (NX) protection for UEFI runtime services**|**Requirements**:
    - VBS will enable NX protection on UEFI runtime service code and data memory regions. UEFI runtime service code must support read-only page protections, and UEFI runtime service data must not be executable. UEFI runtime service must meet these requirements:
    - Implement UEFI 2.6 EFI_MEMORY_ATTRIBUTES_TABLE. All UEFI runtime service memory (code and data) must be described by this table.
    - PE sections must be page-aligned in memory (not required for in non-volatile storage).
    - The Memory Attributes Table needs to correctly mark code and data as RO/NX for configuration by the OS:
    - All entries must include attributes EFI_MEMORY_RO, EFI_MEMORY_XP, or both.
    - No entries may be left with neither of the above attributes, indicating memory that is both executable and writable. Memory must be either readable and executable or writable and non-executable.
    (**SEE IMPORTANT INFORMATION AFTER THIS TABLE**)|Vulnerabilities in UEFI runtime, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
    - Reduces the attack surface to VBS from system firmware.| |Firmware: **Firmware support for SMM protection**|**Requirements**:
    - The [Windows SMM Security Mitigations Table (WSMT) specification](https://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx) contains details of an ACPI table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features.|- Protects against potential vulnerabilities in UEFI runtime services, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
    - Reduces the attack surface to VBS from system firmware.
    - Blocks additional security attacks against SMM.| > [!IMPORTANT] @@ -148,7 +148,7 @@ The following table lists qualifications for Windows 10, version 1703, which are > > Please also note the following: > -> - Do not use sections that are both writeable and executable +> - Do not use sections that are both writable and executable > > - Do not attempt to directly modify executable system memory > From 821c2ac0c367f9eba6f3c51bb5b494816c942d8e Mon Sep 17 00:00:00 2001 From: MatiG Date: Mon, 11 Jan 2021 14:31:09 +0200 Subject: [PATCH 162/206] change log level to debug --- .../microsoft-defender-atp/linux-resources.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md b/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md index 3b12f36855..2fc939ef09 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md @@ -36,20 +36,23 @@ If you can reproduce a problem, first increase the logging level, run the system 1. Increase logging level: ```bash - mdatp log level set --level verbose + mdatp log level set --level debug ``` + ```Output Log level configured successfully ``` 2. Reproduce the problem. -3. Run the following command to back up Defender for Endpoint's logs. The files will be stored inside of a .zip archive. +3. Run the following command to back up Defender for Endpoint's logs. The files will be stored inside of a .zip archive. ```bash sudo mdatp diagnostic create ``` + This command will also print out the file path to the backup after the operation succeeds: + ```Output Diagnostic file created: ``` @@ -59,6 +62,7 @@ If you can reproduce a problem, first increase the logging level, run the system ```bash mdatp log level set --level info ``` + ```Output Log level configured successfully ``` From f0f90ce9d474af605fc0786ecfab269ce0b6ec63 Mon Sep 17 00:00:00 2001 From: MatiG Date: Mon, 11 Jan 2021 14:45:52 +0200 Subject: [PATCH 163/206] adding edr cli documentation --- .../microsoft-defender-atp/linux-resources.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md b/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md index 2fc939ef09..fa1b975d62 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md @@ -128,6 +128,10 @@ The following table lists commands for some of the most common scenarios. Run `m |Quarantine management |Add a file detected as a threat to the quarantine |`mdatp threat quarantine add --id [threat-id]` | |Quarantine management |Remove a file detected as a threat from the quarantine |`mdatp threat quarantine remove --id [threat-id]` | |Quarantine management |Restore a file from the quarantine |`mdatp threat quarantine restore --id [threat-id]` | +|Endpoint Detection and Response |Set early preview (unused) |`mdatp edr early-preview [enable|disable]` | +|Endpoint Detection and Response |Set group-id |`mdatp edr group-ids --group-id [group-id]` | +|Endpoint Detection and Response |Set/Remove tag, only `GROUP` supported |`mdatp edr tag set --name GROUP --value [tag]` | +|Endpoint Detection and Response |list exclusions (root) |`mdatp edr exclusion list [processes|paths|extensions|all]` | ## Microsoft Defender for Endpoint portal information From 3609c8cf1b6aaeef7aa98a2d4eb95f261ede0a55 Mon Sep 17 00:00:00 2001 From: Elizabeth Ross Date: Mon, 11 Jan 2021 08:59:37 -0800 Subject: [PATCH 164/206] Update bitlocker-group-policy-settings.md Updated supported operating systems to include the ones from the previous file we redirected due to formatting issues. --- .../bitlocker/bitlocker-group-policy-settings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md index f6f72e035f..1fa0d3b9e3 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md +++ b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md @@ -22,7 +22,7 @@ ms.custom: bitlocker **Applies to** -- Windows 10 +- Windows 10, Windows Server 2019, Windows Server 2016, Windows 8.1, and Windows Server 2012 R2 This topic for IT professionals describes the function, location, and effect of each Group Policy setting that is used to manage BitLocker Drive Encryption. From 330baaf27cdc43db275c1154478d92b6a96addcf Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 11 Jan 2021 09:01:06 -0800 Subject: [PATCH 165/206] Update microsoft-defender-antivirus-compatibility.md --- .../microsoft-defender-antivirus-compatibility.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md index e2f17d8448..a487a3c18c 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md @@ -13,7 +13,7 @@ ms.author: deniseb ms.custom: nextgen ms.reviewer: pahuijbr, shwjha manager: dansimp -ms.date: 01/04/2021 +ms.date: 01/11/2021 --- # Microsoft Defender Antivirus compatibility @@ -71,7 +71,7 @@ The following table summarizes the functionality and features that are available |State |[Real-time protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus) and [cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus) | [Limited periodic scanning availability](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus) | [File scanning and detection information](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus) | [Threat remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus) | [Security intelligence updates](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus) | |--|--|--|--|--|--| |Active mode

    |Yes |No |Yes |Yes |Yes | -|Passive mode |Yes |No |Yes |Only during [scheduled or on-demand scans](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus) |Yes | +|Passive mode |No |No |Yes |Only during [scheduled or on-demand scans](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus) |Yes | |[EDR in block mode enabled](../microsoft-defender-atp/edr-in-block-mode.md) |No |No |Yes |Yes |Yes | |Automatic disabled mode |No |Yes |No |No |No | From 2c6833a08516d06aa067d0bb27ac08125d2c742e Mon Sep 17 00:00:00 2001 From: Ben Watt <13239035+wattbt@users.noreply.github.com> Date: Mon, 11 Jan 2021 17:09:53 +0000 Subject: [PATCH 166/206] Title text change to new naming The web page title was left still referring to Defender ATP, so updated for Defender for Endpoint. Not sure if other pages also are missing this change when the rest of the page was updated. --- .../microsoft-defender-atp/onboard-offline-machines.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboard-offline-machines.md b/windows/security/threat-protection/microsoft-defender-atp/onboard-offline-machines.md index e3aea210fc..0d267cf0ea 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboard-offline-machines.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboard-offline-machines.md @@ -1,5 +1,5 @@ --- -title: Onboard devices without Internet access to Microsoft Defender ATP +title: Onboard devices without Internet access to Microsoft Defender for Endpoint ms.reviewer: description: Onboard devices without Internet access so that they can send sensor data to the Microsoft Defender ATP sensor keywords: onboard, servers, vm, on-premise, oms gateway, log analytics, azure log analytics, mma From 8b0eada3f567ea5f00ae70bf40252b3b1045bc3c Mon Sep 17 00:00:00 2001 From: Caroline Gitonga Date: Mon, 11 Jan 2021 20:23:32 +0300 Subject: [PATCH 167/206] Update diagnostic data level taxonomy Sections changed: Insider Preview builds and Feedback & diagnostics --- ...ndows-operating-system-components-to-microsoft-services.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 4c6e0b8880..b40f5823e6 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -390,7 +390,7 @@ Windows Insider Preview builds only apply to Windows 10 and are not available fo > [!NOTE] -> If you upgrade a device that is configured to minimize connections from Windows to Microsoft services (that is, a device configured for Restricted Traffic) to a Windows Insider Preview build, the Feedback & Diagnostic setting will automatically be set to **Full**. Although the diagnostic data level may initially appear as **Basic**, a few hours after the UI is refreshed or the machine is rebooted, the setting will become **Full**. +> If you upgrade a device that is configured to minimize connections from Windows to Microsoft services (that is, a device configured for Restricted Traffic) to a Windows Insider Preview build, the Feedback & Diagnostic setting will automatically be set to **Optional (Full)**. Although the diagnostic data level may initially appear as **Required (Basic)**, a few hours after the UI is refreshed or the machine is rebooted, the setting will become **Optional (Full)**. To turn off Insider Preview builds for a released version of Windows 10: @@ -1302,7 +1302,7 @@ To change how frequently **Windows should ask for my feedback**: To change the level of diagnostic and usage data sent when you **Send your device data to Microsoft**: -- Click either the **Basic** or **Full** options. +- Click either the **Required (Basic)** or **Optional (Full)** options. -or- From 650539f1d34c0dbb1a6800fd6279b293c4f7cb15 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 11 Jan 2021 10:23:49 -0800 Subject: [PATCH 168/206] Update microsoft-defender-antivirus-compatibility.md --- .../microsoft-defender-antivirus-compatibility.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md index a487a3c18c..9f5add4dfe 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md @@ -66,7 +66,10 @@ See [Microsoft Defender Antivirus on Windows Server 2016 and 2019](microsoft-def ## Functionality and features available in each state -The following table summarizes the functionality and features that are available in each state: +The table in this section summarizes the functionality and features that are available in each state. + +> [!IMPORTANT] +> The following table is informational, and it is designed to describe the features & capabilities that are turned on or off according to whether Microsoft Defender Antivirus is in Active mode, in Passive mode, or disabled/uninstalled. Do not turn off capabilities, such as real-time protection, if you are using Microsoft Defender Antivirus in passive mode or are using EDR in block mode. |State |[Real-time protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus) and [cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus) | [Limited periodic scanning availability](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus) | [File scanning and detection information](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus) | [Threat remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus) | [Security intelligence updates](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus) | |--|--|--|--|--|--| @@ -78,7 +81,7 @@ The following table summarizes the functionality and features that are available - In Active mode, Microsoft Defender Antivirus is used as the antivirus app on the machine. All configuration made with Configuration Manager, Group Policy, Intune, or other management products will apply. Files are scanned and threats remediated, and detection information are reported in your configuration tool (such as Configuration Manager or the Microsoft Defender Antivirus app on the machine itself). - In Passive mode, Microsoft Defender Antivirus is not used as the antivirus app, and threats are not remediated by Microsoft Defender Antivirus. Files are scanned and reports are provided for threat detections that are shared with the Microsoft Defender for Endpoint service. Therefore, you might encounter alerts in the Security Center console with Microsoft Defender Antivirus as a source, even when Microsoft Defender Antivirus is in Passive mode. - When [EDR in block mode](../microsoft-defender-atp/edr-in-block-mode.md) is turned on and Microsoft Defender Antivirus is not the primary antivirus solution, it can still detect and remediate malicious items. -- When disabled, Microsoft Defender Antivirus is not used as the antivirus app. Files are not scanned and threats are not remediated. +- When disabled, Microsoft Defender Antivirus is not used as the antivirus app. Files are not scanned and threats are not remediated. Disabling/uninstalling Microsoft Defender Antivirus is not recommended. ## Keep the following points in mind From 678b19d2f03169a6448b97193e61492404788766 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 11 Jan 2021 10:30:27 -0800 Subject: [PATCH 169/206] Update microsoft-defender-antivirus-compatibility.md --- .../microsoft-defender-antivirus-compatibility.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md index 9f5add4dfe..066b363f5e 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md @@ -87,7 +87,7 @@ The table in this section summarizes the functionality and features that are ava If you are enrolled in Microsoft Defender for Endpoint and you are using a third-party antimalware product, then passive mode is enabled. [The service requires common information sharing from Microsoft Defender Antivirus service](../microsoft-defender-atp/defender-compatibility.md) in order to properly monitor your devices and network for intrusion attempts and attacks. -When Microsoft Defender Antivirus is automatically disabled, it can automatically re-enabled if the protection offered by a third-party antivirus product expires or otherwise stops providing real-time protection from viruses, malware, or other threats. This is to ensure antivirus protection is maintained on the endpoint. It also allows you to enable [limited periodic scanning](limited-periodic-scanning-microsoft-defender-antivirus.md), which uses the Microsoft Defender Antivirus engine to periodically check for threats in addition to your main antivirus app. +When Microsoft Defender Antivirus is disabled automatically, it can be re-enabled automatically if the protection offered by a non-Microsoft antivirus product expires or otherwise stops providing real-time protection from viruses, malware, or other threats. Automatic re-enabling helps to ensure that antivirus protection is maintained on your devices. It also allows you to enable [limited periodic scanning](limited-periodic-scanning-microsoft-defender-antivirus.md), which uses the Microsoft Defender Antivirus engine to periodically check for threats in addition to your main antivirus app. In passive mode, you can still [manage updates for Microsoft Defender Antivirus](manage-updates-baselines-microsoft-defender-antivirus.md); however, you can't move Microsoft Defender Antivirus into the normal active mode if your endpoints have an up-to-date third-party product providing real-time protection from malware. From a9613ad0aabbe85b8bc9c35ea8fdfe75d916b4eb Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 11 Jan 2021 10:32:31 -0800 Subject: [PATCH 170/206] Update microsoft-defender-antivirus-compatibility.md --- .../microsoft-defender-antivirus-compatibility.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md index 066b363f5e..f58cdac130 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md @@ -1,7 +1,7 @@ --- title: Microsoft Defender Antivirus compatibility with other security products -description: Microsoft Defender Antivirus operates in different ways depending on what other security products you have installed, and the operating system you are using. -keywords: windows defender, atp, advanced threat protection, compatibility, passive mode +description: Get an overview of what to expect from Microsoft Defender Antivirus with other security products and the operating systems you are using. +keywords: windows defender, next-generation, atp, advanced threat protection, compatibility, passive mode search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -11,7 +11,7 @@ ms.localizationpriority: medium author: denisebmsft ms.author: deniseb ms.custom: nextgen -ms.reviewer: pahuijbr, shwjha +ms.reviewer: tewchen, pahuijbr, shwjha manager: dansimp ms.date: 01/11/2021 --- From 41aa1b595f3897f3695d45f1ad0572b1fa3f022e Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Mon, 11 Jan 2021 11:19:46 -0800 Subject: [PATCH 171/206] Release notes for 101.18.53 --- .../microsoft-defender-atp/linux-resources.md | 4 ++-- .../microsoft-defender-atp/linux-whatsnew.md | 10 ++++++++++ 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md b/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md index fa1b975d62..b8e1e244b8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md @@ -114,9 +114,9 @@ The following table lists commands for some of the most common scenarios. Run `m |Configuration |Turn off PUA protection |`mdatp threat policy set --type potentially_unwanted_application --action off` | |Configuration |Turn on audit mode for PUA protection |`mdatp threat policy set --type potentially_unwanted_application --action audit` | |Diagnostics |Change the log level |`mdatp log level set --level verbose [error|warning|info|verbose]` | -|Diagnostics |Generate diagnostic logs |`mdatp diagnostic create` | +|Diagnostics |Generate diagnostic logs |`mdatp diagnostic create --path [directory]` | |Health |Check the product's health |`mdatp health` | -|Protection |Scan a path |`mdatp scan custom --path [path]` | +|Protection |Scan a path |`mdatp scan custom --path [path] [--ignore-exclusions]` | |Protection |Do a quick scan |`mdatp scan quick` | |Protection |Do a full scan |`mdatp scan full` | |Protection |Cancel an ongoing on-demand scan |`mdatp scan cancel` | diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-whatsnew.md b/windows/security/threat-protection/microsoft-defender-atp/linux-whatsnew.md index 85ee3ab500..d769c548fd 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-whatsnew.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-whatsnew.md @@ -23,6 +23,16 @@ ms.topic: conceptual [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] +## 101.18.53 + +- EDR for Linux is now [generally available](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/edr-for-linux-is-now-is-generally-available/ba-p/2048539) +- Added a new command-line switch (`--ignore-exclusions`) to ignore AV exclusions during custom scans (`mdatp scan custom`) +- Extended `mdatp diagnostic create` with a new parameter (`--path [directory]`) that allows the diagnostic logs to be saved to a different directory +- Performance improvements & bug fixes + +## 101.12.99 + +- Performance improvements & bug fixes ## 101.04.76 From 1478980db53529a8d8ae98ccaef2ab31e13faa2d Mon Sep 17 00:00:00 2001 From: Peter Smith Date: Mon, 11 Jan 2021 11:34:53 -0800 Subject: [PATCH 172/206] Removed Lockdown as a setting for VPNv2CSP Lockdown has been removed from the VPNv2CSP code; removing it also from the docs --- windows/client-management/mdm/vpnv2-csp.md | 19 ------------------- 1 file changed, 19 deletions(-) diff --git a/windows/client-management/mdm/vpnv2-csp.md b/windows/client-management/mdm/vpnv2-csp.md index 0325decbfc..dc6cd495a9 100644 --- a/windows/client-management/mdm/vpnv2-csp.md +++ b/windows/client-management/mdm/vpnv2-csp.md @@ -281,25 +281,6 @@ Valid values: Value type is bool. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/**ProfileName**/LockDown** (./Device only profile) -Lockdown profile. - -Valid values: - -- False (default) - this is not a LockDown profile. -- True - this is a LockDown profile. - -When the LockDown profile is turned on, it does the following things: - -- First, it automatically becomes an "always on" profile. -- Second, it can never be disconnected. -- Third, if the profile is not connected, then the user has no network. -- Fourth, no other profiles may be connected or modified. - -A Lockdown profile must be deleted before you can add, remove, or connect other profiles. - -Value type is bool. Supported operations include Get, Add, Replace, and Delete. - **VPNv2/**ProfileName**/DeviceTunnel** (./Device only profile) Device tunnel profile. From 8e59e45f291825c2eed5c019b36dfedde0a8d7a1 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Mon, 11 Jan 2021 12:38:46 -0800 Subject: [PATCH 173/206] Add note on versions out of support --- .../threat-protection/microsoft-defender-atp/linux-whatsnew.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-whatsnew.md b/windows/security/threat-protection/microsoft-defender-atp/linux-whatsnew.md index d769c548fd..db4c18a233 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-whatsnew.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-whatsnew.md @@ -23,6 +23,9 @@ ms.topic: conceptual [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] +> [!IMPORTANT] +> Product versions 101.04.76 and older are nearing end of support. Customers running on version 101.04.76 or older must upgrade to a newer version of Microsoft Defender for Endpoint for Linux by February 1st, 2021. + ## 101.18.53 - EDR for Linux is now [generally available](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/edr-for-linux-is-now-is-generally-available/ba-p/2048539) From db5a79e110ef77e18da095687b054ef75552df0f Mon Sep 17 00:00:00 2001 From: Elizabeth Ross Date: Mon, 11 Jan 2021 12:56:01 -0800 Subject: [PATCH 174/206] Update windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../bitlocker/bitlocker-group-policy-settings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md index 1fa0d3b9e3..2bda9b48ce 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md +++ b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md @@ -20,7 +20,7 @@ ms.custom: bitlocker # BitLocker Group Policy settings -**Applies to** +**Applies to:** - Windows 10, Windows Server 2019, Windows Server 2016, Windows 8.1, and Windows Server 2012 R2 From 89b2ef370b1929801d7a1645dd8d9096e496377c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 11 Jan 2021 13:04:37 -0800 Subject: [PATCH 175/206] add windows virtual desktop support --- .../microsoft-defender-atp/minimum-requirements.md | 1 + .../whats-new-in-microsoft-defender-atp.md | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md b/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md index 96515f8a95..714f80adb2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md +++ b/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md @@ -95,6 +95,7 @@ Access to Defender for Endpoint is done through a browser, supporting the follow - Windows Server 2016 - Windows Server, version 1803 or later - Windows Server 2019 +- Windows Virtual Desktop Devices on your network must be running one of these editions. diff --git a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md index 9a8ae62bdb..43382105c2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md @@ -40,6 +40,11 @@ For more information preview features, see [Preview features](https://docs.micro > https://docs.microsoft.com/api/search/rss?search=%22Microsoft+Defender+ATP+as+well+as+security+features+in+Windows+10+and+Windows+Server.%22&locale=en-us > ``` + +## January 2021 + +- [Windows Virtual Desktop](https://azure.microsoft.com/services/virtual-desktop/)
    Microsoft Defender for Endpoint now adds support for Windows Virtual Desktop. + ## December 2020 - [Microsoft Defender for Endpoint for iOS](microsoft-defender-atp-ios.md)
    Microsoft Defender for Endpoint now adds support for iOS. Learn how to install, configure, update, and use Microsoft Defender for Endpoint for iOS. From 4d670199bb53eff8180f0af844126af53b28b4be Mon Sep 17 00:00:00 2001 From: julihooper <65675989+julihooper@users.noreply.github.com> Date: Mon, 11 Jan 2021 13:50:05 -0800 Subject: [PATCH 176/206] Update defender-csp.md adding CSP description for DisableLocalAdminMerge config. --- windows/client-management/mdm/defender-csp.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index da9959c0a2..21e9063233 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -390,6 +390,25 @@ Intune tamper protection setting UX supports three states: When enabled or disabled exists on the client and admin moves the setting to not configured, it will not have any impact on the device state. To change the state to either enabled or disabled would require to be set explicitly. +**Configuration/DisableLocalAdminMerge**
    +This policy setting controls whether or not complex list settings configured by a local administrator are merged with managed settings. This setting applies to lists such as threats and exclusions. + +If you disable or do not configure this setting, unique items defined in preference settings configured by the local administrator will be merged into the resulting effective policy. In the case of conflicts, management settings will override preference settings. + +If you enable this setting, only items defined by management will be used in the resulting effective policy. Managed settings will override preference settings configured by the local administrator. + +**Note:** Applying this setting will not remove exclusions from the device registry, it will only prevent them from being applied/used. This is reflected in Get-MpPreference. + +Supported OS versions: Windows 10 + +The data type is integer. + +Supported operations are Add, Delete, Get, Replace. + +Valid values are: +- 1 – Enable. +- 0 (default) – Disable. + **Configuration/EnableFileHashComputation** Enables or disables file hash computation feature. When this feature is enabled Windows defender will compute hashes for files it scans. From e09556520a05b088fcd23f619c8ac8794a58d3b3 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Mon, 11 Jan 2021 14:17:10 -0800 Subject: [PATCH 177/206] Revert notice pending further discussion with PM --- .../threat-protection/microsoft-defender-atp/linux-whatsnew.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-whatsnew.md b/windows/security/threat-protection/microsoft-defender-atp/linux-whatsnew.md index db4c18a233..d769c548fd 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-whatsnew.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-whatsnew.md @@ -23,9 +23,6 @@ ms.topic: conceptual [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -> [!IMPORTANT] -> Product versions 101.04.76 and older are nearing end of support. Customers running on version 101.04.76 or older must upgrade to a newer version of Microsoft Defender for Endpoint for Linux by February 1st, 2021. - ## 101.18.53 - EDR for Linux is now [generally available](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/edr-for-linux-is-now-is-generally-available/ba-p/2048539) From 1c80371f586cc218260256c79a76499a42100f92 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Mon, 11 Jan 2021 14:46:02 -0800 Subject: [PATCH 178/206] Corrected note style --- windows/client-management/mdm/defender-csp.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index 21e9063233..37205534c5 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -397,7 +397,8 @@ If you disable or do not configure this setting, unique items defined in prefere If you enable this setting, only items defined by management will be used in the resulting effective policy. Managed settings will override preference settings configured by the local administrator. -**Note:** Applying this setting will not remove exclusions from the device registry, it will only prevent them from being applied/used. This is reflected in Get-MpPreference. +> [!NOTE] +> Applying this setting will not remove exclusions from the device registry, it will only prevent them from being applied/used. This is reflected in **Get-MpPreference**. Supported OS versions: Windows 10 From 708e8a2e60fc4af35a494852c7a17546fbc8ab9f Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 11 Jan 2021 15:10:26 -0800 Subject: [PATCH 179/206] last seen updates --- .../threat-protection/microsoft-defender-atp/machine.md | 2 +- .../microsoft-defender-atp/machines-view-overview.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/machine.md b/windows/security/threat-protection/microsoft-defender-atp/machine.md index ab02cb5c21..53bdfe131c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/machine.md +++ b/windows/security/threat-protection/microsoft-defender-atp/machine.md @@ -54,7 +54,7 @@ Property | Type | Description id | String | [machine](machine.md) identity. computerDnsName | String | [machine](machine.md) fully qualified name. firstSeen | DateTimeOffset | First date and time where the [machine](machine.md) was observed by Microsoft Defender for Endpoint. -lastSeen | DateTimeOffset | Last date and time where the [machine](machine.md) was observed by Microsoft Defender for Endpoint. +lastSeen | DateTimeOffset |Time and date of the last received full device report. A device typically sends a full report every 24 hours. osPlatform | String | Operating system platform. version | String | Operating system Version. osBuild | Nullable long | Operating system build number. diff --git a/windows/security/threat-protection/microsoft-defender-atp/machines-view-overview.md b/windows/security/threat-protection/microsoft-defender-atp/machines-view-overview.md index fae0dfc00e..efae39c258 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/machines-view-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/machines-view-overview.md @@ -28,7 +28,7 @@ ms.topic: article >Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-machinesview-abovefoldlink) -The **Devices list** shows a list of the devices in your network where alerts were generated. By default, the queue displays devices with alerts seen in the last 30 days. +The **Devices list** shows a list of the devices in your network where alerts were generated. By default, the queue displays devices seen in the last 30 days. At a glance you'll see information such as domain, risk level, OS platform, and other details for easy identification of devices most at risk. From 7a7450e0f652a6f5ee5a6246139b4612e03dd664 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 11 Jan 2021 15:39:05 -0800 Subject: [PATCH 180/206] Update microsoft-defender-antivirus-compatibility.md --- .../microsoft-defender-antivirus-compatibility.md | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md index f58cdac130..d1fbec7602 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md @@ -85,16 +85,16 @@ The table in this section summarizes the functionality and features that are ava ## Keep the following points in mind -If you are enrolled in Microsoft Defender for Endpoint and you are using a third-party antimalware product, then passive mode is enabled. [The service requires common information sharing from Microsoft Defender Antivirus service](../microsoft-defender-atp/defender-compatibility.md) in order to properly monitor your devices and network for intrusion attempts and attacks. +- If you are enrolled in Microsoft Defender for Endpoint and you are using a third-party antimalware product, then passive mode is enabled. [The service requires common information sharing from Microsoft Defender Antivirus service](../microsoft-defender-atp/defender-compatibility.md) in order to properly monitor your devices and network for intrusion attempts and attacks. -When Microsoft Defender Antivirus is disabled automatically, it can be re-enabled automatically if the protection offered by a non-Microsoft antivirus product expires or otherwise stops providing real-time protection from viruses, malware, or other threats. Automatic re-enabling helps to ensure that antivirus protection is maintained on your devices. It also allows you to enable [limited periodic scanning](limited-periodic-scanning-microsoft-defender-antivirus.md), which uses the Microsoft Defender Antivirus engine to periodically check for threats in addition to your main antivirus app. +- When Microsoft Defender Antivirus is disabled automatically, it can be re-enabled automatically if the protection offered by a non-Microsoft antivirus product expires or otherwise stops providing real-time protection from viruses, malware, or other threats. Automatic re-enabling helps to ensure that antivirus protection is maintained on your devices. It also allows you to enable [limited periodic scanning](limited-periodic-scanning-microsoft-defender-antivirus.md), which uses the Microsoft Defender Antivirus engine to periodically check for threats in addition to your main antivirus app. -In passive mode, you can still [manage updates for Microsoft Defender Antivirus](manage-updates-baselines-microsoft-defender-antivirus.md); however, you can't move Microsoft Defender Antivirus into the normal active mode if your endpoints have an up-to-date third-party product providing real-time protection from malware. +- When Microsoft Defender Antivirus is in passive mode, you can still [manage updates for Microsoft Defender Antivirus](manage-updates-baselines-microsoft-defender-antivirus.md); however, you can't move Microsoft Defender Antivirus into active mode if your devices have an up-to-date, non-Microsoft antivirus product providing real-time protection from malware. -If you uninstall the other product, and choose to use Microsoft Defender Antivirus to provide protection to your endpoints, Microsoft Defender Antivirus will automatically return to its normal active mode. + If you uninstall the non-Microsoft antivirus product, and use Microsoft Defender Antivirus to provide protection to your devices, Microsoft Defender Antivirus will return to its normal active mode automatically. > [!WARNING] -> You should not attempt to disable, stop, or modify any of the associated services used by Microsoft Defender Antivirus, Microsoft Defender for Endpoint, or the Windows Security app. This includes the *wscsvc*, *SecurityHealthService*, *MsSense*, *Sense*, *WinDefend*, or *MsMpEng* services and process. Manually modifying these services can cause severe instability on your endpoints and open your network to infections and attacks. It can also cause problems when using third-party antivirus apps and how their information is displayed in the [Windows Security app](microsoft-defender-security-center-antivirus.md). +> Do not disable, stop, or modify any of the associated services that are used by Microsoft Defender Antivirus, Microsoft Defender for Endpoint, or the Windows Security app. This includes the *wscsvc*, *SecurityHealthService*, *MsSense*, *Sense*, *WinDefend*, or *MsMpEng* services and processes. Manually modifying these services can cause severe instability on your devices and can make your network vulnerable. Disabling, stopping, or modifying those services can also cause problems when using non-Microsoft antivirus solutions and how their information is displayed in the [Windows Security app](microsoft-defender-security-center-antivirus.md). ## See also @@ -103,5 +103,4 @@ If you uninstall the other product, and choose to use Microsoft Defender Antivir - [Microsoft Defender Antivirus on Windows Server 2016 and 2019](microsoft-defender-antivirus-on-windows-server-2016.md) - [EDR in block mode](../microsoft-defender-atp/edr-in-block-mode.md) - [Configure Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection-configure) -- [Configure Endpoint Protection on a standalone client](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection-configure-standalone-client) - [Learn about Microsoft 365 Endpoint data loss prevention](https://docs.microsoft.com/microsoft-365/compliance/endpoint-dlp-learn-about) From bd675d72c5f6b59b8699f473ca28cd1a60a2b9a8 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 11 Jan 2021 15:51:45 -0800 Subject: [PATCH 181/206] delete page --- .openpublishing.redirection.json | 5 ++ .../get-machinegroups-collection.md | 89 ------------------- 2 files changed, 5 insertions(+), 89 deletions(-) delete mode 100644 windows/security/threat-protection/microsoft-defender-atp/get-machinegroups-collection.md diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 9e3480430e..0cf060785e 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -1534,6 +1534,11 @@ "source_path": "windows/security/threat-protection/windows-defender-atp/get-machinegroups-collection.md", "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machinegroups-collection", "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/get-machinegroups-collection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list", + "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-defender-atp/get-machinesecuritystates-collection-windows-defender-advanced-threat-protection.md", diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-machinegroups-collection.md b/windows/security/threat-protection/microsoft-defender-atp/get-machinegroups-collection.md deleted file mode 100644 index 925103b0d1..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/get-machinegroups-collection.md +++ /dev/null @@ -1,89 +0,0 @@ ---- -title: Get RBAC machine groups collection API -description: Learn how to use the Get KB collection API to retrieve a collection of RBAC device groups in Microsoft Defender Advanced Threat Protection. -keywords: apis, graph api, supported apis, get, RBAC, group -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: leonidzh -author: mjcaparas -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article -ms.date: 10/07/2018 ---- - -# Get KB collection API - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) - -- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) - -[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] - -[!include[Improve request performance](../../includes/improve-request-performance.md)] - - -Retrieves a collection of RBAC device groups. - -## Permissions -User needs read permissions. - -## HTTP request -``` -GET /testwdatppreview/machinegroups -``` - -## Request headers - -Header | Value -:---|:--- -Authorization | Bearer {token}. **Required**. -Content type | application/json - -## Request body -Empty - -## Response -If successful - 200 OK. - -## Example - -**Request** - -Here is an example of the request. - -``` -GET https://graph.microsoft.com/testwdatppreview/machinegroups -Content-type: application/json -``` - -**Response** - -Here is an example of the response. -Field id contains device group **id** and equal to field **rbacGroupId** in devices info. -Field **ungrouped** is true only for one group for all devices that have not been assigned to any group. This group as usual has name "UnassignedGroup". - -``` -HTTP/1.1 200 OK -Content-type: application/json -{ - "@odata.context":"https://graph.microsoft.com/testwdatppreview/$metadata#MachineGroups", - "@odata.count":7, - "value":[ - { - "id":86, - "name":"UnassignedGroup", - "description":"", - "ungrouped":true}, - … -} -``` From 70bfcd4ce48432ceba03373a03ad7a47dcc45714 Mon Sep 17 00:00:00 2001 From: schmurky Date: Tue, 12 Jan 2021 13:19:27 +0800 Subject: [PATCH 182/206] changed ATP to Endpoint --- .../microsoft-defender-atp/investigate-files.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md index a9e415015a..940312a02f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md @@ -20,7 +20,7 @@ ms.topic: article ms.date: 04/24/2018 --- -# Investigate a file associated with a Microsoft Defender ATP alert +# Investigate a file associated with a Microsoft Defender for Endpoint alert [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] From c4fa84e1dc3620c144718bc29780aa8bcdf697b9 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Mon, 11 Jan 2021 21:58:03 -0800 Subject: [PATCH 183/206] Add release notes for MDEP for Mac 101.19.21 --- .../threat-protection/microsoft-defender-atp/mac-whatsnew.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md index 692a50914e..4f5d0daced 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md @@ -29,6 +29,10 @@ ms.topic: conceptual > [!IMPORTANT] > Support for macOS 10.13 (High Sierra) will be discontinued on February 15th, 2021. +## 101.19.21 + +- Bug fixes + ## 101.15.26 - Improved the reliability of the agent when running on macOS 11 Big Sur From 7073288e7ecb0c5b166e4dacf48db018e8ae861f Mon Sep 17 00:00:00 2001 From: amirsc3 <42802974+amirsc3@users.noreply.github.com> Date: Tue, 12 Jan 2021 14:51:51 +0200 Subject: [PATCH 184/206] Update live-response.md fixed missing command in the example --- .../threat-protection/microsoft-defender-atp/live-response.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index 193c067a32..df1251aaec 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -186,7 +186,7 @@ Here are some examples: |Command |What it does | |---------|---------| -|`"C:\windows\some_file.exe" &` |Starts downloading a file named *some_file.exe* in the background. | +|`Download "C:\windows\some_file.exe" &` |Starts downloading a file named *some_file.exe* in the background. | |`fg 1234` |Returns a download with command ID *1234* to the foreground. | From 4228e205afdb313a4c91bcc1a72d3cf56a9eae1b Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik <36546697+jborsecnik@users.noreply.github.com> Date: Tue, 12 Jan 2021 08:44:55 -0800 Subject: [PATCH 185/206] fix pre-existing typo "behaviours" --- .../microsoft-defender-atp/investigate-files.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md index 940312a02f..3ac5eb62bb 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md @@ -1,6 +1,6 @@ --- title: Investigate Microsoft Defender Advanced Threat Protection files -description: Use the investigation options to get details on files associated with alerts, behaviours, or events. +description: Use the investigation options to get details on files associated with alerts, behaviors, or events. keywords: investigate, investigation, file, malicious activity, attack motivation, deep analysis, deep analysis report search.product: eADQiWindows 10XVcnh search.appverid: met150 From e89aa7b54a4b532f16bcc9baf35ebd3df4d1a2b2 Mon Sep 17 00:00:00 2001 From: Matthew Palko Date: Tue, 12 Jan 2021 10:07:54 -0800 Subject: [PATCH 186/206] update face authentication areas for masks --- .../hello-for-business/hello-biometrics-in-enterprise.md | 6 +++++- .../identity-protection/hello-for-business/hello-faq.yml | 8 ++++++-- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md index 01dffaef6d..c7680c8fe3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md +++ b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md @@ -15,7 +15,7 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium -ms.date: 03/05/2020 +ms.date: 01/12/2021 --- # Windows Hello biometrics in the enterprise @@ -81,6 +81,10 @@ To allow facial recognition, you must have devices with integrated special infra - Effective, real world FRR with Anti-spoofing or liveness detection: <10% +> [!NOTE] +>Windows Hello face authentication does not currently support wearing a mask during enrollment or authentication. Wearing a mask to enroll is a security concern because other users wearing a similar mask may be able to unlock you device. The product group is aware of this behavior and is investigating this topic further. Please remove a mask if you are wearing one when you enroll or unlock with Windows Hello face authentication. If your working environment doesn’t allow you to remove a mask temporarily, please consider unenrolling from face authentication and only using PIN or fingerprint. + + ## Related topics - [Windows Hello for Business](hello-identity-verification.md) - [How Windows Hello for Business works](hello-how-it-works.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index aae7b07f4a..d7a41ce150 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -14,7 +14,7 @@ metadata: ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium - ms.date: 08/19/2018 + ms.date: 01/12/2021 ms.reviewer: title: Windows Hello for Business Frequently Asked Questions (FAQ) @@ -137,7 +137,11 @@ sections: - question: Can I use both a PIN and biometrics to unlock my device? answer: | Starting in Windows 10, version 1709, you can use multi-factor unlock to require users to provide an additional factor to unlock their device. Authentication remains two-factor, but another factor is required before Windows allows the user to reach the desktop. To learn more, see [Multifactor Unlock](feature-multifactor-unlock.md). - + + - question: Can I wear a mask to enroll or unlock using Windows Hello face authentication? + answer: | + Wearing a mask to enroll is a security concern because other users wearing a similar mask may be able to unlock you device. The product group is aware of this behavior and is investigating this topic further. Please remove a mask if you are wearing one when you enroll or unlock with Windows Hello face authentication. If your working environment doesn’t allow you to remove a mask temporarily, please consider unenrolling from face authentication and only using PIN or fingerprint. + - question: What's the difference between Windows Hello and Windows Hello for Business? answer: | Windows Hello represents the biometric framework provided in Windows 10. Windows Hello lets users use biometrics to sign in to their devices by securely storing their user name and password and releasing it for authentication when the user successfully identifies themselves using biometrics. Windows Hello for Business uses asymmetric keys protected by the device's security module that requires a user gesture (PIN or biometrics) to authenticate. From 86bed88682697c4f85e3fa2f4daa8f3dede89f31 Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik <36546697+jborsecnik@users.noreply.github.com> Date: Tue, 12 Jan 2021 10:45:02 -0800 Subject: [PATCH 187/206] Update hello-biometrics-in-enterprise.md regards --> regard per Acrolinx --- .../hello-for-business/hello-biometrics-in-enterprise.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md index c7680c8fe3..d0857ccd72 100644 --- a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md +++ b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md @@ -53,7 +53,7 @@ The biometric data used to support Windows Hello is stored on the local device o ## Has Microsoft set any device requirements for Windows Hello? We've been working with the device manufacturers to help ensure a high-level of performance and protection is met by each sensor and device, based on these requirements: -- **False Accept Rate (FAR).** Represents the instance a biometric identification solution verifies an unauthorized person. This is normally represented as a ratio of number of instances in a given population size, for example 1 in 100 000. This can also be represented as a percentage of occurrence, for example, 0.001%. This measurement is heavily considered the most important with regards to the security of the biometric algorithm. +- **False Accept Rate (FAR).** Represents the instance a biometric identification solution verifies an unauthorized person. This is normally represented as a ratio of number of instances in a given population size, for example 1 in 100 000. This can also be represented as a percentage of occurrence, for example, 0.001%. This measurement is heavily considered the most important with regard to the security of the biometric algorithm. - **False Reject Rate (FRR).** Represents the instances a biometric identification solution fails to verify an authorized person correctly. Usually represented as a percentage, the sum of the True Accept Rate and False Reject Rate is 1. Can be with or without anti-spoofing or liveness detection. From a88fc360e88d4663857949ff7bf93c36932e35ed Mon Sep 17 00:00:00 2001 From: Matthew Palko Date: Tue, 12 Jan 2021 12:04:19 -0800 Subject: [PATCH 188/206] update hybrid cert trust adfs scope note --- .../hello-hybrid-cert-whfb-settings-adfs.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md index 8a9763ebcd..f301ec009c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md @@ -65,14 +65,17 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva 7. Restart the AD FS server. > [!NOTE] ->For AD FS 2019, if Windows Hello for Business with a Hybrid Certificate trust is performed, a known PRT issue exists. You may encounter this error in ADFS Admin event logs: Received invalid Oauth request. The client 'NAME' is forbidden to access the resource with scope 'ugs'. To remediate this error: +> For AD FS 2019, if Windows Hello for Business with a Hybrid Certificate trust is performed, a known PRT issue exists. You may encounter this error in ADFS Admin event logs: Received invalid Oauth request. The client 'NAME' is forbidden to access the resource with scope 'ugs'. To remediate this error: > > 1. Launch AD FS management console. Browse to "Services > Scope Descriptions". > 2. Right click "Scope Descriptions" and select "Add Scope Description". > 3. Under name type "ugs" and Click Apply > OK. -> 4. Launch Powershell as Administrator. -> 5. Execute the command "Get-AdfsApplicationPermission". Look for the ScopeNames :{openid, aza} that has the ClientRoleIdentifier is equal to 38aa3b87-a06d-4817-b275-7a316988d93b and make a note of the ObjectIdentifier. -> 6. Execute the command "Set-AdfsApplicationPermission -TargetIdentifier -AddScope 'ugs'. +> 4. Launch PowerShell as an administrator. +> 5. Get the ObjectIdentifier of the application permission with the ClientRoleIdentifier parameter equal to "38aa3b87-a06d-4817-b275-7a316988d93b": +> ```PowerShell +> (Get-AdfsApplicationPermission -ServerRoleIdentifiers 'http://schemas.microsoft.com/ws/2009/12/identityserver/selfscope' | ?{ $_.ClientRoleIdentifier -eq '38aa3b87-a06d-4817-b275-7a316988d93b' }).ObjectIdentifier +> ``` +> 6. Execute the command `Set-AdfsApplicationPermission -TargetIdentifier -AddScope 'ugs'`. > 7. Restart the ADFS service. > 8. On the client: Restart the client. User should be prompted to provision WHFB. > 9. If the provisioning window does not pop up then need to collect NGC trace logs and further troubleshoot. From c27c8d67503bb45cc8139081c0afad99ffc0f5e7 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 12 Jan 2021 12:23:39 -0800 Subject: [PATCH 189/206] Update common-exclusion-mistakes-microsoft-defender-antivirus.md --- ...n-mistakes-microsoft-defender-antivirus.md | 120 ++---------------- 1 file changed, 11 insertions(+), 109 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md index d33ce3552f..c4401ca56a 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md @@ -26,128 +26,30 @@ This article describes some common mistake that you should avoid when defining e Before defining your exclusion lists, see [Recommendations for defining exclusions](configure-exclusions-microsoft-defender-antivirus.md#recommendations-for-defining-exclusions). ## Excluding certain trusted items -Certain files, file types, folders, or processes should not be excluded from scanning even though you trust them to be not malicious. Refer to the following section for items that you should not exclude from scanning. -**Do not add exclusions for the following folder locations:** +Certain files, file types, folders, or processes should not be excluded from scanning even though you trust them to be not malicious. -- %systemdrive% -- C: -- C:\ -- C:\* -- %ProgramFiles%\Java -- C:\Program Files\Java -- %ProgramFiles%\Contoso\ -- C:\Program Files\Contoso\ -- %ProgramFiles(x86)%\Contoso\ -- C:\Program Files (x86)\Contoso\ -- C:\Temp -- C:\Temp\ -- C:\Temp\* -- C:\Users\ -- C:\Users\* -- C:\Users\\AppData\Local\Temp\ -- C:\Users\\AppData\LocalLow\Temp\ -- C:\Users\\AppData\Roaming\Temp\ -- %Windir%\Prefetch -- C:\Windows\Prefetch -- C:\Windows\Prefetch\ -- C:\Windows\Prefetch\* -- %Windir%\System32\Spool -- C:\Windows\System32\Spool -- C:\Windows\System32\CatRoot2 -- %Windir%\Temp -- C:\Windows\Temp -- C:\Windows\Temp\ -- C:\Windows\Temp\* +Do not define exclusions for the folder locations, file extensions, and processes that are listed in the following table: -**Do not add exclusions for the following file extensions:** -- `.7zip` -- `.bat` -- `.bin` -- `.cab` -- `.cmd` -- `.com` -- `.cpl` -- `.dll` -- `.exe` -- `.fla` -- `.gif` -- `.gz` -- `.hta` -- `.inf` -- `.java` -- `.jar` -- `.job` -- `.jpeg` -- `.jpg` -- `.js` -- `.ko` -- `.ko.gz` -- `.msi` -- `.ocx` -- `.png` -- `.ps1` -- `.py` -- `.rar` -- `.reg` -- `.scr` -- `.sys` -- `.tar` -- `.tmp` -- `.url` -- `.vbe` -- `.vbs` -- `.wsf` -- `.zip` +| Folder locations | File extensions | Processes | +|:--|:--|:--| +| `%systemdrive%`
    `C:`
    `C:\`
    `C:\*`
    `%ProgramFiles%\Java`
    `C:\Program Files\Java`
    `%ProgramFiles%\Contoso\`
    `C:\Program Files\Contoso\`
    `%ProgramFiles(x86)%\Contoso\`
    `C:\Program Files (x86)\Contoso\`
    `C:\Temp`
    `C:\Temp\`
    `C:\Temp\*`
    `C:\Users\`
    `C:\Users\*`
    `C:\Users\\AppData\Local\Temp\`
    `C:\Users\\AppData\LocalLow\Temp\`
    `C:\Users\\AppData\Roaming\Temp\`
    `%Windir%\Prefetch`
    `C:\Windows\Prefetch`
    `C:\Windows\Prefetch\`
    `C:\Windows\Prefetch\*`
    `%Windir%\System32\Spool`
    `C:\Windows\System32\Spool`
    `C:\Windows\System32\CatRoot2`
    `%Windir%\Temp`
    `C:\Windows\Temp`
    `C:\Windows\Temp\`
    `C:\Windows\Temp\*` | `.7zip`
    `.bat`
    `.bin`
    `.cab`
    `.cmd`
    `.com`
    `.cpl`
    `.dll`
    `.exe`
    `.fla`
    `.gif`
    `.gz`
    `.hta`
    `.inf`
    `.java`
    `.jar`
    `.job`
    `.jpeg`
    `.jpg`
    `.js`
    `.ko`
    `.ko.gz`
    `.msi`
    `.ocx`
    `.png`
    `.ps1`
    `.py`
    `.rar`
    `.reg`
    `.scr`
    `.sys`
    `.tar`
    `.tmp`
    `.url`
    `.vbe`
    `.vbs`
    `.wsf`
    `.zip` | `AcroRd32.exe`
    `bitsadmin.exe`
    `excel.exe`
    `iexplore.exe`
    `java.exe`
    `outlook.exe`
    `psexec.exe`
    `powerpnt.exe`
    `powershell.exe`
    `schtasks.exe`
    `svchost.exe`
    `wmic.exe`
    `winword.exe`
    `wuauclt.exe`
    `addinprocess.exe`
    `addinprocess32.exe`
    `addinutil.exe`
    `bash.exe`
    `bginfo.exe`[1]
    `cdb.exe`
    `csi.exe`
    `dbghost.exe`
    `dbgsvc.exe`
    `dnx.exe`
    `fsi.exe`
    `fsiAnyCpu.exe`
    `kd.exe`
    `ntkd.exe`
    `lxssmanager.dll`
    `msbuild.exe`[2]
    `mshta.exe`
    `ntsd.exe`
    `rcsi.exe`
    `system.management.automation.dll`
    `windbg.exe` | >[!NOTE] -> You can chose to exclude file types, such as .gif, .jpg, .jpeg, .png if your environment has a modern, up-to-date software with a strict update policy to handle any vulnerabilities. - -**Do not add exclusions for the following processes:** -- AcroRd32.exe -- bitsadmin.exe -- excel.exe -- iexplore.exe -- java.exe -- outlook.exe -- psexec.exe -- powerpnt.exe -- powershell.exe -- schtasks.exe -- svchost.exe -- wmic.exe -- winword.exe -- wuauclt.exe -- addinprocess.exe -- addinprocess32.exe -- addinutil.exe -- bash.exe -- bginfo.exe[1] -- cdb.exe -- csi.exe -- dbghost.exe -- dbgsvc.exe -- dnx.exe -- fsi.exe -- fsiAnyCpu.exe -- kd.exe -- ntkd.exe -- lxssmanager.dll -- msbuild.exe[2] -- mshta.exe -- ntsd.exe -- rcsi.exe -- system.management.automation.dll -- windbg.exe +> You can chose to exclude file types, such as `.gif`, `.jpg`, `.jpeg`, or `.png` if your environment has a modern, up-to-date software with a strict update policy to handle any vulnerabilities. ## Using just the file name in the exclusion list -A malware may have the same name as that of the file that you trust and want to exclude from scanning. Therefore, to avoid excluding a potential malware from scanning, use a fully qualified path to the file that you want to exclude instead of using just the file name. For example, if you want to exclude **Filename.exe** from scanning, use the complete path to the file, such as **C:\program files\contoso\Filename.exe**. + +A malware may have the same name as that of the file that you trust and want to exclude from scanning. Therefore, to avoid excluding a potential malware from scanning, use a fully qualified path to the file that you want to exclude instead of using just the file name. For example, if you want to exclude `Filename.exe` from scanning, use the complete path to the file, such as `C:\program files\contoso\Filename.exe`. ## Using a single exclusion list for multiple server workloads + Do not use a single exclusion list to define exclusions for multiple server workloads. Split the exclusions for different application or service workloads into multiple exclusion lists. For example, the exclusion list for your IIS Server workload must be different from the exclusion list for your SQL Server workload. ## Using incorrect environment variables as wildcards in the file name and folder path or extension exclusion lists + Microsoft Defender Antivirus Service runs in system context using the LocalSystem account, which means it gets information from the system environment variable, and not from the user environment variable. Use of environment variables as a wildcard in exclusion lists is limited to system variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. Therefore, do not use user environment variables as wildcards when adding Microsoft Defender Antivirus folder and process exclusions. See the table under [System environment variables](configure-extension-file-exclusions-microsoft-defender-antivirus.md#system-environment-variables) for a complete list of system environment variables. + See [Use wildcards in the file name and folder path or extension exclusion lists](configure-extension-file-exclusions-microsoft-defender-antivirus.md#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists) for information on how to use wildcards in exclusion lists. ## Related articles From 38c178a46b614dfdcf63f215d2d83dcaf758abdf Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 12 Jan 2021 12:25:20 -0800 Subject: [PATCH 190/206] Update TOC.md --- windows/security/threat-protection/TOC.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 25a5417d95..99c0b4887e 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -195,8 +195,7 @@ ##### [Customize, initiate, and review the results of scans and remediation]() ###### [Configuration overview](microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus.md) -###### [Configure and validate exclusions in antivirus scans]() -###### [Exclusions overview](microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md) +###### [Configure and validate exclusions in antivirus scans](microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md) ###### [Configure and validate exclusions based on file name, extension, and folder location](microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md) ###### [Configure and validate exclusions for files opened by processes](microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) ###### [Configure antivirus exclusions Windows Server](microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md) From e5a5466ec95e154c7c4c774cea0b2e2a4ea38db2 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 12 Jan 2021 12:38:23 -0800 Subject: [PATCH 191/206] AV content fixes --- ...exclusions-microsoft-defender-antivirus.md | 2 - ...exclusions-microsoft-defender-antivirus.md | 40 ++----------------- 2 files changed, 4 insertions(+), 38 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md index 725634e323..4943302a17 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md @@ -77,8 +77,6 @@ See [How to create and deploy antimalware policies: Exclusion settings](https:// 5. Click **OK**. -![The Group Policy setting for specifying process exclusions](images/defender/wdav-process-exclusions.png) - ### Use PowerShell cmdlets to exclude files that have been opened by specified processes from scans Using PowerShell to add or remove exclusions for files that have been opened by processes requires using a combination of three cmdlets with the `-ExclusionProcess` parameter. The cmdlets are all in the [Defender module](https://technet.microsoft.com/itpro/powershell/windows/defender/defender). diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md index 7c834bd8e4..3ac64a1e57 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md @@ -204,43 +204,11 @@ This section lists the default exclusions for all Windows Server 2016 and 2019 r #### Hyper-V exclusions -This section lists the file type exclusions, folder exclusions, and process exclusions that are delivered automatically when you install the Hyper-V role +The following table lists the file type exclusions, folder exclusions, and process exclusions that are delivered automatically when you install the Hyper-V role. -- File type exclusions: - - - `*.vhd` - - - `*.vhdx` - - - `*.avhd` - - - `*.avhdx` - - - `*.vsv` - - - `*.iso` - - - `*.rct` - - - `*.vmcx` - - - `*.vmrs` - -- Folder exclusions: - - - `%ProgramData%\Microsoft\Windows\Hyper-V` - - - `%ProgramFiles%\Hyper-V` - - - `%SystemDrive%\ProgramData\Microsoft\Windows\Hyper-V\Snapshots` - - - `%Public%\Documents\Hyper-V\Virtual Hard Disks` - -- Process exclusions: - - - `%systemroot%\System32\Vmms.exe` - - - `%systemroot%\System32\Vmwp.exe` +|File type exclusions |Folder exclusions | Process exclusions | +|:--|:--|:--| +| `*.vhd`
    `*.vhdx`
    `*.avhd`
    `*.avhdx`
    `*.vsv`
    `*.iso`
    `*.rct`
    `*.vmcx`
    `*.vmrs` | `%ProgramData%\Microsoft\Windows\Hyper-V`
    `%ProgramFiles%\Hyper-V`
    `%SystemDrive%\ProgramData\Microsoft\Windows\Hyper-V\Snapshots`
    `%Public%\Documents\Hyper-V\Virtual Hard Disks` | `%systemroot%\System32\Vmms.exe`
    `%systemroot%\System32\Vmwp.exe` | #### SYSVOL files From 6325beafe40f41a4d79f250ef22b4a650fdf39e0 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 12 Jan 2021 12:39:54 -0800 Subject: [PATCH 192/206] Update configure-extension-file-exclusions-microsoft-defender-antivirus.md --- ...n-file-exclusions-microsoft-defender-antivirus.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md index 88a2e71534..37b5c8ad0a 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md @@ -36,12 +36,12 @@ You can exclude certain files from Microsoft Defender Antivirus scans by modifyi This article describes how to configure exclusion lists for the files and folders. See [Recommendations for defining exclusions](configure-exclusions-microsoft-defender-antivirus.md#recommendations-for-defining-exclusions) before defining your exclusion lists. -Exclusion | Examples | Exclusion list ----|---|--- -Any file with a specific extension | All files with the specified extension, anywhere on the machine.
    Valid syntax: `.test` and `test` | Extension exclusions -Any file under a specific folder | All files under the `c:\test\sample` folder | File and folder exclusions -A specific file in a specific folder | The file `c:\sample\sample.test` only | File and folder exclusions -A specific process | The executable file `c:\test\process.exe` | File and folder exclusions +| Exclusion | Examples | Exclusion list | +|:---|:---|:---| +|Any file with a specific extension | All files with the specified extension, anywhere on the machine.
    Valid syntax: `.test` and `test` | Extension exclusions | +|Any file under a specific folder | All files under the `c:\test\sample` folder | File and folder exclusions | +| A specific file in a specific folder | The file `c:\sample\sample.test` only | File and folder exclusions | +| A specific process | The executable file `c:\test\process.exe` | File and folder exclusions | Exclusion lists have the following characteristics: From 80ced9e5f49884b8fdff4ff41d5aa245c5390963 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 12 Jan 2021 12:42:50 -0800 Subject: [PATCH 193/206] Update configure-extension-file-exclusions-microsoft-defender-antivirus.md --- ...exclusions-microsoft-defender-antivirus.md | 52 ++++++++----------- 1 file changed, 23 insertions(+), 29 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md index 37b5c8ad0a..2643fbb1a0 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md @@ -48,21 +48,18 @@ Exclusion lists have the following characteristics: - Folder exclusions apply to all files and folders under that folder, unless the subfolder is a reparse point. Reparse point subfolders must be excluded separately. - File extensions apply to any file name with the defined extension if a path or folder is not defined. ->[!IMPORTANT] ->Using wildcards such as the asterisk (\*) will alter how the exclusion rules are interpreted. See the [Use wildcards in the file name and folder path or extension exclusion lists](#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists) section for important information about how wildcards work. -> ->You cannot exclude mapped network drives. You must specify the actual network path. -> ->Folders that are reparse points that are created after the Microsoft Defender Antivirus service starts and that have been added to the exclusion list will not be included. You must restart the service (by restarting Windows) for new reparse points to be recognized as a valid exclusion target. +> [!IMPORTANT] +> - Using wildcards such as the asterisk (\*) will alter how the exclusion rules are interpreted. See the [Use wildcards in the file name and folder path or extension exclusion lists](#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists) section for important information about how wildcards work. +> - You cannot exclude mapped network drives. You must specify the actual network path. +> - Folders that are reparse points that are created after the Microsoft Defender Antivirus service starts and that have been added to the exclusion list will not be included. You must restart the service (by restarting Windows) for new reparse points to be recognized as a valid exclusion target. To exclude files opened by a specific process, see [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md). The exclusions apply to [scheduled scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md), [on-demand scans](run-scan-microsoft-defender-antivirus.md), and [real-time protection](configure-real-time-protection-microsoft-defender-antivirus.md). ->[!IMPORTANT] ->Exclusion list changes made with Group Policy **will show** in the lists in the [Windows Security app](microsoft-defender-security-center-antivirus.md#exclusions). -> ->Changes made in the Windows Security app **will not show** in the Group Policy lists. +> [!IMPORTANT] +> Exclusion list changes made with Group Policy **will show** in the lists in the [Windows Security app](microsoft-defender-security-center-antivirus.md#exclusions). +> Changes made in the Windows Security app **will not show** in the Group Policy lists. By default, local changes made to the lists (by users with administrator privileges, including changes made with PowerShell and WMI) will be merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, or Intune. The Group Policy lists take precedence when there are conflicts. @@ -134,13 +131,13 @@ Remove item from the list | `Remove-MpPreference` The following are allowed as the ``: -Exclusion type | PowerShell parameter ----|--- -All files with a specified file extension | `-ExclusionExtension` -All files under a folder (including files in subdirectories), or a specific file | `-ExclusionPath` +| Exclusion type | PowerShell parameter | +|:---|:---| +| All files with a specified file extension | `-ExclusionExtension` | +| All files under a folder (including files in subdirectories), or a specific file | `-ExclusionPath` | ->[!IMPORTANT] ->If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. +> [!IMPORTANT] +> If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. For example, the following code snippet would cause Microsoft Defender AV scans to exclude any file with the `.test` file extension: @@ -175,29 +172,26 @@ See [Add exclusions in the Windows Security app](microsoft-defender-security-cen You can use the asterisk `*`, question mark `?`, or environment variables (such as `%ALLUSERSPROFILE%`) as wildcards when defining items in the file name or folder path exclusion list. The way in which these wildcards are interpreted differs from their usual usage in other apps and languages. Make sure to read this section to understand their specific limitations. ->[!IMPORTANT] ->There are key limitations and usage scenarios for these wildcards: -> ->- Environment variable usage is limited to machine variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. ->- You cannot use a wildcard in place of a drive letter. ->- An asterisk `*` in a folder exclusion stands in place for a single folder. Use multiple instances of `\*\` to indicate multiple nested folders with unspecified names. +> [!IMPORTANT] +> There are key limitations and usage scenarios for these wildcards: +> - Environment variable usage is limited to machine variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. +> - You cannot use a wildcard in place of a drive letter. +> - An asterisk `*` in a folder exclusion stands in place for a single folder. Use multiple instances of `\*\` to indicate multiple nested folders with unspecified names. The following table describes how the wildcards can be used and provides some examples. |Wildcard |Examples | -|---------|---------| +|:---------|:---------| |`*` (asterisk)

    In **file name and file extension inclusions**, the asterisk replaces any number of characters, and only applies to files in the last folder defined in the argument.

    In **folder exclusions**, the asterisk replaces a single folder. Use multiple `*` with folder slashes `\` to indicate multiple nested folders. After matching the number of wild carded and named folders, all subfolders are also included. | `C:\MyData\*.txt` would include `C:\MyData\notes.txt`

    `C:\somepath\*\Data` would include any file in `C:\somepath\Archives\Data and its subfolders` and `C:\somepath\Authorized\Data and its subfolders`

    `C:\Serv\*\*\Backup` would include any file in `C:\Serv\Primary\Denied\Backup and its subfolders` and `C:\Serv\Secondary\Allowed\Backup and its subfolders` | |`?` (question mark)

    In **file name and file extension inclusions**, the question mark replaces a single character, and only applies to files in the last folder defined in the argument.

    In **folder exclusions**, the question mark replaces a single character in a folder name. After matching the number of wild carded and named folders, all subfolders are also included. |`C:\MyData\my?` would include `C:\MyData\my1.zip`

    `C:\somepath\?\Data` would include any file in `C:\somepath\P\Data` and its subfolders

    `C:\somepath\test0?\Data` would include any file in `C:\somepath\test01\Data` and its subfolders | |Environment variables

    The defined variable is populated as a path when the exclusion is evaluated. |`%ALLUSERSPROFILE%\CustomLogFiles` would include `C:\ProgramData\CustomLogFiles\Folder1\file1.txt` | ->[!IMPORTANT] ->If you mix a file exclusion argument with a folder exclusion argument, the rules will stop at the file argument match in the matched folder, and will not look for file matches in any subfolders. -> ->For example, you can exclude all files that start with "date" in the folders `c:\data\final\marked` and `c:\data\review\marked` by using the rule argument `c:\data\*\marked\date*`. -> ->This argument, however, will not match any files in subfolders under `c:\data\final\marked` or `c:\data\review\marked`. +> [!IMPORTANT] +> If you mix a file exclusion argument with a folder exclusion argument, the rules will stop at the file argument match in the matched folder, and will not look for file matches in any subfolders. +> For example, you can exclude all files that start with "date" in the folders `c:\data\final\marked` and `c:\data\review\marked` by using the rule argument `c:\data\*\marked\date*`. +> This argument, however, will not match any files in subfolders under `c:\data\final\marked` or `c:\data\review\marked`. From b25fa3e84517722d7da5c09172084dfbacf199fb Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 12 Jan 2021 13:12:44 -0800 Subject: [PATCH 194/206] Update configure-extension-file-exclusions-microsoft-defender-antivirus.md --- ...exclusions-microsoft-defender-antivirus.md | 329 ++++-------------- 1 file changed, 62 insertions(+), 267 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md index 2643fbb1a0..6715d17298 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md @@ -199,273 +199,68 @@ The following table describes how the wildcards can be used and provides some ex The following table lists and describes the system account environment variables. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    System environment variablesWill redirect to:
    %APPDATA%C:\Users\UserName.DomainName\AppData\Roaming
    %APPDATA%\Microsoft\Internet Explorer\Quick LaunchC:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch
    %APPDATA%\Microsoft\Windows\Start MenuC:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu
    %APPDATA%\Microsoft\Windows\Start Menu\ProgramsC:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
    %LOCALAPPDATA% C:\Windows\System32\config\systemprofile\AppData\Local
    %ProgramData%C:\ProgramData
    %ProgramFiles%C:\Program Files
    %ProgramFiles%\Common Files C:\Program Files\Common Files
    %ProgramFiles%\Windows Sidebar\Gadgets C:\Program Files\Windows Sidebar\Gadgets
    %ProgramFiles%\Common FilesC:\Program Files\Common Files
    %ProgramFiles(x86)% C:\Program Files (x86)
    %ProgramFiles(x86)%\Common Files C:\Program Files (x86)\Common Files
    %SystemDrive%C:
    %SystemDrive%\Program FilesC:\Program Files
    %SystemDrive%\Program Files (x86) C:\Program Files (x86)
    %SystemDrive%\Users C:\Users
    %SystemDrive%\Users\PublicC:\Users\Public
    %SystemRoot% C:\Windows
    %windir%C:\Windows
    %windir%\FontsC:\Windows\Fonts
    %windir%\Resources C:\Windows\Resources
    %windir%\resources\0409C:\Windows\resources\0409
    %windir%\system32C:\Windows\System32
    %ALLUSERSPROFILE%C:\ProgramData
    %ALLUSERSPROFILE%\Application DataC:\ProgramData\Application Data
    %ALLUSERSPROFILE%\DocumentsC:\ProgramData\Documents
    %ALLUSERSPROFILE%\Documents\My Music\Sample Music -

    C:\ProgramData\Documents\My Music\Sample Music

    -

    .

    -
    %ALLUSERSPROFILE%\Documents\My Music C:\ProgramData\Documents\My Music
    %ALLUSERSPROFILE%\Documents\My Pictures -

    C:\ProgramData\Documents\My Pictures -

    -
    %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures C:\ProgramData\Documents\My Pictures\Sample Pictures
    %ALLUSERSPROFILE%\Documents\My Videos C:\ProgramData\Documents\My Videos
    %ALLUSERSPROFILE%\Microsoft\Windows\DeviceMetadataStore C:\ProgramData\Microsoft\Windows\DeviceMetadataStore
    %ALLUSERSPROFILE%\Microsoft\Windows\GameExplorer C:\ProgramData\Microsoft\Windows\GameExplorer
    %ALLUSERSPROFILE%\Microsoft\Windows\Ringtones C:\ProgramData\Microsoft\Windows\Ringtones
    %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu C:\ProgramData\Microsoft\Windows\Start Menu
    %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs C:\ProgramData\Microsoft\Windows\Start Menu\Programs
    %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Administrative ToolsC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\StartUp C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
    %ALLUSERSPROFILE%\Microsoft\Windows\Templates C:\ProgramData\Microsoft\Windows\Templates
    %ALLUSERSPROFILE%\Start Menu C:\ProgramData\Start Menu
    %ALLUSERSPROFILE%\Start Menu\Programs C:\ProgramData\Start Menu\Programs
    %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools C:\ProgramData\Start Menu\Programs\Administrative Tools
    %ALLUSERSPROFILE%\Templates C:\ProgramData\Templates
    %LOCALAPPDATA%\Microsoft\Windows\ConnectedSearch\Templates C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\ConnectedSearch\Templates
    %LOCALAPPDATA%\Microsoft\Windows\History C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History
    -

    -%PUBLIC%

    -    		C:\Users\Public
    %PUBLIC%\AccountPictures C:\Users\Public\AccountPictures
    %PUBLIC%\Desktop C:\Users\Public\Desktop
    %PUBLIC%\Documents C:\Users\Public\Documents
    %PUBLIC%\Downloads C:\Users\Public\Downloads
    %PUBLIC%\Music\Sample Music -

    C:\Users\Public\Music\Sample Music

    -

    .

    -
    %PUBLIC%\Music\Sample Playlists -

    C:\Users\Public\Music\Sample Playlists

    -

    .

    -
    %PUBLIC%\Pictures\Sample Pictures C:\Users\Public\Pictures\Sample Pictures
    %PUBLIC%\RecordedTV.library-msC:\Users\Public\RecordedTV.library-ms
    %PUBLIC%\VideosC:\Users\Public\Videos
    %PUBLIC%\Videos\Sample Videos -

    C:\Users\Public\Videos\Sample Videos

    -

    .

    -
    %USERPROFILE% C:\Windows\System32\config\systemprofile
    %USERPROFILE%\AppData\Local C:\Windows\System32\config\systemprofile\AppData\Local
    %USERPROFILE%\AppData\LocalLow C:\Windows\System32\config\systemprofile\AppData\LocalLow
    %USERPROFILE%\AppData\Roaming C:\Windows\System32\config\systemprofile\AppData\Roaming
    +| This system environment variable... | Redirects to this | +|:--|:--| +| `%APPDATA%`| `C:\Users\UserName.DomainName\AppData\Roaming` | +| `%APPDATA%\Microsoft\Internet Explorer\Quick Launch` | `C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch` | +| `%APPDATA%\Microsoft\Windows\Start Menu` | `C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu` | +| `%APPDATA%\Microsoft\Windows\Start Menu\Programs` | `C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs` | +| `%LOCALAPPDATA%` | `C:\Windows\System32\config\systemprofile\AppData\Local` | +| `%ProgramData%` | `C:\ProgramData` | +| `%ProgramFiles%` | `C:\Program Files` | +| `%ProgramFiles%\Common Files` | `C:\Program Files\Common Files` | +| `%ProgramFiles%\Windows Sidebar\Gadgets` | `C:\Program Files\Windows Sidebar\Gadgets` | +| `%ProgramFiles%\Common Files` | `C:\Program Files\Common Files` | +| `%ProgramFiles(x86)%` | `C:\Program Files (x86)` | +| `%ProgramFiles(x86)%\Common Files` | `C:\Program Files (x86)\Common Files` | +| `%SystemDrive%` | `C:` | +| `%SystemDrive%\Program Files` | `C:\Program Files` | +| `%SystemDrive%\Program Files (x86)` | `C:\Program Files (x86)` | +| `%SystemDrive%\Users` | `C:\Users` | +| `%SystemDrive%\Users\Public` | `C:\Users\Public` | +| `%SystemRoot%` | `C:\Windows` | +| `%windir%` | `C:\Windows` | +| `%windir%\Fonts` | `C:\Windows\Fonts` | +| `%windir%\Resources` | `C:\Windows\Resources` | +| `%windir%\resources\0409` | `C:\Windows\resources\0409` | +| `%windir%\system32` | `C:\Windows\System32` | +| `%ALLUSERSPROFILE%` | `C:\ProgramData` | +| `%ALLUSERSPROFILE%\Application Data` | `C:\ProgramData\Application Data` | +| `%ALLUSERSPROFILE%\Documents` | `C:\ProgramData\Documents` | +| `%ALLUSERSPROFILE%\Documents\My Music\Sample Music` | `C:\ProgramData\Documents\My Music\Sample Music` | +| `%ALLUSERSPROFILE%\Documents\My Music` | `C:\ProgramData\Documents\My Music` | +| `%ALLUSERSPROFILE%\Documents\My Pictures` | `C:\ProgramData\Documents\My Pictures` | +| `%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures` | `C:\ProgramData\Documents\My Pictures\Sample Pictures` | +| `%ALLUSERSPROFILE%\Documents\My Videos` | `C:\ProgramData\Documents\My Videos` | +| `%ALLUSERSPROFILE%\Microsoft\Windows\DeviceMetadataStore` | `C:\ProgramData\Microsoft\Windows\DeviceMetadataStore` | +| `%ALLUSERSPROFILE%\Microsoft\Windows\GameExplorer` | `C:\ProgramData\Microsoft\Windows\GameExplorer` | +| `%ALLUSERSPROFILE%\Microsoft\Windows\Ringtones` | `C:\ProgramData\Microsoft\Windows\Ringtones` | +| `%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu` | `C:\ProgramData\Microsoft\Windows\Start Menu` | +| `%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs` | `C:\ProgramData\Microsoft\Windows\Start Menu\Programs` | +| `%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Administrative Tools` | `C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools` | +| `%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\StartUp` | `C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp` | +| `%ALLUSERSPROFILE%\Microsoft\Windows\Templates` | `C:\ProgramData\Microsoft\Windows\Templates` | +| `%ALLUSERSPROFILE%\Start Menu` | `C:\ProgramData\Start Menu` | +| `%ALLUSERSPROFILE%\Start Menu\Programs` | C:\ProgramData\Start Menu\Programs | +| `%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools` | `C:\ProgramData\Start Menu\Programs\Administrative Tools` | +| `%ALLUSERSPROFILE%\Templates` | `C:\ProgramData\Templates` | +| `%LOCALAPPDATA%\Microsoft\Windows\ConnectedSearch\Templates` | `C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\ConnectedSearch\Templates` | +| `%LOCALAPPDATA%\Microsoft\Windows\History` | `C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History` | +| `%PUBLIC%` | `C:\Users\Public` | +| `%PUBLIC%\AccountPictures` | `C:\Users\Public\AccountPictures` | +| `%PUBLIC%\Desktop` | `C:\Users\Public\Desktop` | +| `%PUBLIC%\Documents` | `C:\Users\Public\Documents` | +| `%PUBLIC%\Downloads` | `C:\Users\Public\Downloads` | +| `%PUBLIC%\Music\Sample Music` | `C:\Users\Public\Music\Sample Music` | +| `%PUBLIC%\Music\Sample Playlists` | `C:\Users\Public\Music\Sample Playlists` | +| `%PUBLIC%\Pictures\Sample Pictures` | `C:\Users\Public\Pictures\Sample Pictures` | +| `%PUBLIC%\RecordedTV.library-ms` | `C:\Users\Public\RecordedTV.library-ms` | +| `%PUBLIC%\Videos` | `C:\Users\Public\Videos` | +| `%PUBLIC%\Videos\Sample Videos` | `C:\Users\Public\Videos\Sample Videos` | +| `%USERPROFILE%` | `C:\Windows\System32\config\systemprofile` | +| `%USERPROFILE%\AppData\Local` | `C:\Windows\System32\config\systemprofile\AppData\Local` | +| `%USERPROFILE%\AppData\LocalLow` | `C:\Windows\System32\config\systemprofile\AppData\LocalLow` | +| `%USERPROFILE%\AppData\Roaming` | `C:\Windows\System32\config\systemprofile\AppData\Roaming` | ## Review the list of exclusions From 88dbf9fdaddb2dbd1ef54532128c81cbb41bdffc Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 12 Jan 2021 13:14:48 -0800 Subject: [PATCH 195/206] Update configure-extension-file-exclusions-microsoft-defender-antivirus.md --- ...n-file-exclusions-microsoft-defender-antivirus.md | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md index 6715d17298..a969dcf58a 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md @@ -12,7 +12,6 @@ ms.author: deniseb ms.custom: nextgen ms.reviewer: manager: dansimp -ms.date: 10/21/2020 --- # Configure and validate exclusions based on file extension and folder location @@ -107,7 +106,6 @@ See [How to create and deploy antimalware policies: Exclusion settings](https:// 7. Click **OK**. - ![The Group Policy setting for extension exclusions](images/defender/wdav-extension-exclusions.png) @@ -123,11 +121,11 @@ The format for the cmdlets is as follows: The following are allowed as the ``: -Configuration action | PowerShell cmdlet ----|--- -Create or overwrite the list | `Set-MpPreference` -Add to the list | `Add-MpPreference` -Remove item from the list | `Remove-MpPreference` +| Configuration action | PowerShell cmdlet | +|:---|:---| +|Create or overwrite the list | `Set-MpPreference` | +|Add to the list | `Add-MpPreference` | +|Remove item from the list | `Remove-MpPreference` | The following are allowed as the ``: From d536a77139a0cc30d5069ca781cc11292500cd4b Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 12 Jan 2021 13:16:03 -0800 Subject: [PATCH 196/206] Update configure-exclusions-microsoft-defender-antivirus.md --- .../configure-exclusions-microsoft-defender-antivirus.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md index 4d3ba69753..55b286bcf0 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md @@ -10,7 +10,6 @@ ms.localizationpriority: medium author: denisebmsft ms.author: deniseb ms.custom: nextgen -ms.date: 03/12/2020 ms.reviewer: manager: dansimp --- @@ -41,8 +40,11 @@ Defining exclusions lowers the protection offered by Microsoft Defender Antiviru The following is a list of recommendations that you should keep in mind when defining exclusions: - Exclusions are technically a protection gap—always consider additional mitigations when defining exclusions. Additional mitigations could be as simple as making sure the excluded location has the appropriate access-control lists (ACLs), audit policy, is processed by an up-to-date software, etc. + - Review the exclusions periodically. Re-check and re-enforce the mitigations as part of the review process. + - Ideally, avoid defining proactive exclusions. For instance, don't exclude something just because you think it might be a problem in the future. Use exclusions only for specific issues—mostly around performance, or sometimes around application compatibility that exclusions could mitigate. + - Audit the exclusion list changes. The security admin should preserve enough context around why a certain exclusion was added. You should be able to provide answer with specific reasoning as to why a certain path was excluded. ## Related articles From a6e292c1822bd0b912fe5fa4c871cb9e5388935c Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 12 Jan 2021 13:20:50 -0800 Subject: [PATCH 197/206] Update configure-process-opened-file-exclusions-microsoft-defender-antivirus.md --- ...ocess-opened-file-exclusions-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md index 4943302a17..db2519b9ab 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md @@ -104,7 +104,7 @@ For example, the following code snippet would cause Microsoft Defender AV scans Add-MpPreference -ExclusionProcess "c:\internal\test.exe" ``` -For more information on how to use PowerShell with Microsoft Defender Antivirus, see Manage antivirus with PowerShell cmdlets and [Microsoft Defender Antivirus cmdlets](https://docs.microsoft.com/powershell/module/defender/?view=win10-ps&preserve=true). +For more information on how to use PowerShell with Microsoft Defender Antivirus, see Manage antivirus with PowerShell cmdlets and [Microsoft Defender Antivirus cmdlets](https://docs.microsoft.com/powershell/module/defender). ### Use Windows Management Instruction (WMI) to exclude files that have been opened by specified processes from scans From 006f0e658ee935411581f4ef272b3495b89ec7c0 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Tue, 12 Jan 2021 13:21:20 -0800 Subject: [PATCH 198/206] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 0cf060785e..edaafad269 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -16510,6 +16510,11 @@ "redirect_url": "https://docs.microsoft.com/mem/autopilot/windows-autopilot", "redirect_document_id": true }, + { + "source_path": "windows/security/threat-protection/mbsa-removal-and-guidance.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection", + "redirect_document_id": true + }, { "source_path": "windows/hub/windows-10.yml", "redirect_url": "https://docs.microsoft.com/windows/windows-10", From 308a4437c19903e4eba7b154e92ad991db15676d Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 12 Jan 2021 13:21:29 -0800 Subject: [PATCH 199/206] Update configure-process-opened-file-exclusions-microsoft-defender-antivirus.md --- ...ocess-opened-file-exclusions-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md index db2519b9ab..4d432355f1 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md @@ -108,7 +108,7 @@ For more information on how to use PowerShell with Microsoft Defender Antivirus, ### Use Windows Management Instruction (WMI) to exclude files that have been opened by specified processes from scans -Use the [**Set**, **Add**, and **Remove** methods of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties: +Use the [**Set**, **Add**, and **Remove** methods of the **MSFT_MpPreference**](https://docs.microsoft.com/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class for the following properties: ```WMI ExclusionProcess From 1ccca48e53b4bef374612464b0fbcba1280732af Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 12 Jan 2021 13:22:04 -0800 Subject: [PATCH 200/206] Update configure-process-opened-file-exclusions-microsoft-defender-antivirus.md --- ...ocess-opened-file-exclusions-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md index 4d432355f1..14b6cea060 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md @@ -116,7 +116,7 @@ ExclusionProcess The use of **Set**, **Add**, and **Remove** is analogous to their counterparts in PowerShell: `Set-MpPreference`, `Add-MpPreference`, and `Remove-MpPreference`. -For more information and allowed parameters, see [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx). +For more information and allowed parameters, see [Windows Defender WMIv2 APIs](https://docs.microsoft.com/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal). ### Use the Windows Security app to exclude files that have been opened by specified processes from scans From 659fbcd62042f39f0e2eb33e9b8426b8a3e3bb7c Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Tue, 12 Jan 2021 13:22:08 -0800 Subject: [PATCH 201/206] Delete mbsa-removal-and-guidance.md --- .../mbsa-removal-and-guidance.md | 44 ------------------- 1 file changed, 44 deletions(-) delete mode 100644 windows/security/threat-protection/mbsa-removal-and-guidance.md diff --git a/windows/security/threat-protection/mbsa-removal-and-guidance.md b/windows/security/threat-protection/mbsa-removal-and-guidance.md deleted file mode 100644 index 59f32f84e6..0000000000 --- a/windows/security/threat-protection/mbsa-removal-and-guidance.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Guide to removing Microsoft Baseline Security Analyzer (MBSA) -description: This article documents the removal of Microsoft Baseline Security Analyzer (MBSA) and provides alternative solutions. -keywords: MBSA, security, removal -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.author: dansimp -author: dulcemontemayor -ms.date: 10/05/2018 -ms.reviewer: -manager: dansimp ---- - -# What is Microsoft Baseline Security Analyzer and its uses? - -Microsoft Baseline Security Analyzer (MBSA) is used to verify patch compliance. MBSA also performed several other security checks for Windows, IIS, and SQL Server. Unfortunately, the logic behind these additional checks had not been actively maintained since Windows XP and Windows Server 2003. Changes in the products since then rendered many of these security checks obsolete and some of their recommendations counterproductive. - -MBSA was largely used in situations where neither Microsoft Update nor a local WSUS or Configuration Manager server was available, or as a compliance tool to ensure that all security updates were deployed to a managed environment. While MBSA version 2.3 introduced support for Windows Server 2012 R2 and Windows 8.1, it has since been deprecated and no longer developed. MBSA 2.3 is not updated to fully support Windows 10 and Windows Server 2016. - -> [!NOTE] -> In accordance with our [SHA-1 deprecation initiative](https://aka.ms/sha1deprecation), the Wsusscn2.cab file is no longer dual-signed using both SHA-1 and the SHA-2 suite of hash algorithms (specifically SHA-256). This file is now signed using only SHA-256. Administrators who verify digital signatures on this file should now expect only single SHA-256 signatures. Starting with the August 2020 Wsusscn2.cab file, MBSA will return the following error "The catalog file is damaged or an invalid catalog." when attempting to scan using the offline scan file. - -## The Solution -A script can help you with an alternative to MBSA’s patch-compliance checking: - -- [Using WUA to Scan for Updates Offline](https://docs.microsoft.com/windows/desktop/wua_sdk/using-wua-to-scan-for-updates-offline), which includes a sample .vbs script. -For a PowerShell alternative, see [Using WUA to Scan for Updates Offline with PowerShell](https://gallery.technet.microsoft.com/Using-WUA-to-Scan-for-f7e5e0be). - -For example: - -[![VBS script](images/vbs-example.png)](https://docs.microsoft.com/windows/desktop/wua_sdk/using-wua-to-scan-for-updates-offline) -[![PowerShell script](images/powershell-example.png)](https://gallery.technet.microsoft.com/Using-WUA-to-Scan-for-f7e5e0be) - -The preceding scripts leverage the [WSUS offline scan file](https://support.microsoft.com/help/927745/detailed-information-for-developers-who-use-the-windows-update-offline) (wsusscn2.cab) to perform a scan and get the same information on missing updates as MBSA supplied. MBSA also relied on the wsusscn2.cab to determine which updates were missing from a given system without connecting to any online service or server. The wsusscn2.cab file is still available and there are currently no plans to remove or replace it. -The wsusscn2.cab file contains the metadata of only security updates, update rollups and service packs available from Microsoft Update; it does not contain any information on non-security updates, tools or drivers. - -## More Information - -For security compliance and for desktop/server hardening, we recommend the Microsoft Security Baselines and the Security Compliance Toolkit. - -- [Windows security baselines](windows-security-baselines.md) -- [Download Microsoft Security Compliance Toolkit 1.0](https://www.microsoft.com/download/details.aspx?id=55319) -- [Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/) From d173252d051e82c185b9393208f4c8f2cbee3ae9 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 12 Jan 2021 13:23:06 -0800 Subject: [PATCH 202/206] Update configure-process-opened-file-exclusions-microsoft-defender-antivirus.md --- ...ess-opened-file-exclusions-microsoft-defender-antivirus.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md index 14b6cea060..51ae6f0011 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md @@ -164,7 +164,7 @@ Use the following cmdlet: Get-MpPreference ``` -See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Microsoft Defender Antivirus. +See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://docs.microsoft.com/en-us/powershell/module/defender) for more information on how to use PowerShell with Microsoft Defender Antivirus. ### Retrieve a specific exclusions list by using PowerShell @@ -175,7 +175,7 @@ $WDAVprefs = Get-MpPreference $WDAVprefs.ExclusionProcess ``` -See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Microsoft Defender Antivirus. +See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://docs.microsoft.com/powershell/module/defender) for more information on how to use PowerShell with Microsoft Defender Antivirus. ## Related articles From 32e33487a5d384ee2b7611c7d6824fd64ec63bb2 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 12 Jan 2021 13:31:38 -0800 Subject: [PATCH 203/206] antivirus --- ...exclusions-microsoft-defender-antivirus.md | 21 +++++++++---------- ...exclusions-microsoft-defender-antivirus.md | 2 +- 2 files changed, 11 insertions(+), 12 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md index a969dcf58a..dcf0ef8305 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md @@ -28,7 +28,7 @@ manager: dansimp ## Exclusion lists -You can exclude certain files from Microsoft Defender Antivirus scans by modifying exclusion lists. **Generally, you shouldn't need to apply exclusions**. Microsoft Defender Antivirus includes a number of automatic exclusions based on known operating system behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations. +You can exclude certain files from Microsoft Defender Antivirus scans by modifying exclusion lists. **Generally, you shouldn't need to apply exclusions**. Microsoft Defender Antivirus includes many automatic exclusions based on known operating system behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations. > [!NOTE] > Automatic exclusions apply only to Windows Server 2016 and above. These exclusions are not visible in the Windows Security app and in PowerShell. @@ -81,31 +81,30 @@ See [How to create and deploy antimalware policies: Exclusion settings](https:// >[!NOTE] >If you specify a fully qualified path to a file, then only that file is excluded. If a folder is defined in the exclusion, then all files and subdirectories under that folder are excluded. -1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and select **Administrative templates**. -3. Expand the tree to **Windows components > Microsoft Defender Antivirus > Exclusions**. +3. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Exclusions**. -4. Double-click the **Path Exclusions** setting and add the exclusions. +4. Open the **Path Exclusions** setting for editing, and add your exclusions. - Set the option to **Enabled**. - Under the **Options** section, click **Show...**. - Specify each folder on its own line under the **Value name** column. - If you are specifying a file, ensure you enter a fully qualified path to the file, including the drive letter, folder path, filename, and extension. Enter **0** in the **Value** column. -5. Click **OK**. +5. Choose **OK**. ![The Group Policy setting for file and folder exclusions](images/defender/wdav-path-exclusions.png) -6. Double-click the **Extension Exclusions** setting and add the exclusions. +6. Open the **Extension Exclusions** setting for editing and add your exclusions. - Set the option to **Enabled**. - - Under the **Options** section, click **Show...**. + - Under the **Options** section, select **Show...**. - Enter each file extension on its own line under the **Value name** column. Enter **0** in the **Value** column. -7. Click **OK**. - +7. Choose **OK**. @@ -277,7 +276,7 @@ You can retrieve the items in the exclusion list using one of the following meth If you use PowerShell, you can retrieve the list in two ways: -- Retrieve the status of all Microsoft Defender Antivirus preferences. Each of the lists are displayed on separate lines, but the items within each list are combined into the same line. +- Retrieve the status of all Microsoft Defender Antivirus preferences. Each list is displayed on separate lines, but the items within each list are combined into the same line. - Write the status of all preferences to a variable, and use that variable to only call the specific list you are interested in. Each use of `Add-MpPreference` is written to a new line. ### Validate the exclusion list by using MpCmdRun diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md index 51ae6f0011..968b2a6975 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md @@ -164,7 +164,7 @@ Use the following cmdlet: Get-MpPreference ``` -See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://docs.microsoft.com/en-us/powershell/module/defender) for more information on how to use PowerShell with Microsoft Defender Antivirus. +See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://docs.microsoft.com/powershell/module/defender) for more information on how to use PowerShell with Microsoft Defender Antivirus. ### Retrieve a specific exclusions list by using PowerShell From 2fde0b93007535aa84cce056c82774709f95c9a9 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 12 Jan 2021 13:32:35 -0800 Subject: [PATCH 204/206] Update configure-process-opened-file-exclusions-microsoft-defender-antivirus.md --- ...ess-opened-file-exclusions-microsoft-defender-antivirus.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md index 968b2a6975..466126fe0d 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md @@ -152,8 +152,8 @@ To check exclusions with the dedicated [command-line tool mpcmdrun.exe](https:// MpCmdRun.exe -CheckExclusion -path ``` ->[!NOTE] ->Checking exclusions with MpCmdRun requires Microsoft Defender Antivirus CAMP version 4.18.1812.3 (released in December 2018) or later. +> [!NOTE] +> Checking exclusions with MpCmdRun requires Microsoft Defender Antivirus CAMP version 4.18.1812.3 (released in December 2018) or later. ### Review the list of exclusions alongside all other Microsoft Defender Antivirus preferences by using PowerShell From 01d866018e9f61aa59e4b27d9822c6100eba9e1d Mon Sep 17 00:00:00 2001 From: Thomas Raya Date: Tue, 12 Jan 2021 14:29:21 -0800 Subject: [PATCH 205/206] remove mbsa-removal-and-guidance from TOC --- windows/security/threat-protection/TOC.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 25a5417d95..90d6dfa378 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -1334,7 +1334,6 @@ #### [Windows security baselines](windows-security-configuration-framework/windows-security-baselines.md) ##### [Security Compliance Toolkit](windows-security-configuration-framework/security-compliance-toolkit-10.md) ##### [Get support](windows-security-configuration-framework/get-support-for-security-baselines.md) -### [MBSA removal and alternatives](mbsa-removal-and-guidance.md) ### [Windows 10 Mobile security guide](windows-10-mobile-security-guide.md) From b4bbcfefa942343ea8f11d5621a5e85d588f7edd Mon Sep 17 00:00:00 2001 From: dstrome Date: Wed, 13 Jan 2021 00:29:22 +0000 Subject: [PATCH 206/206] Initialize Docs repository: https://github.com/MicrosoftDocs/windows-docs-pr of branch master --- .openpublishing.publish.config.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index 3e1c1d1d11..f9ebdac192 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -390,7 +390,7 @@ "elizapo@microsoft.com" ], "sync_notification_subscribers": [ - "daniha@microsoft.com" + "dstrome@microsoft.com" ], "branches_to_filter": [ "" @@ -431,9 +431,9 @@ "template_folder": "_themes.pdf" } }, - "need_generate_pdf": false, - "need_generate_intellisense": false, "docs_build_engine": { "name": "docfx_v3" - } -} + }, + "need_generate_pdf": false, + "need_generate_intellisense": false +} \ No newline at end of file

    f^r0nf4tvTdu@)P!brkyX4K$Jt(8roVnR)kBq+ zMrcl&?-{yckZDO)z5IyFQmy7VmHx6~Am>)UEyO3c6CPLpd3i^T?+O?FR>Q(gu`%a& zmGAgg_+fqkX!*;LftNrK!;G5&AR##NGFQo`rtczd{H&2Zwn zLc94n^tJ1;Y?pX!_aJA?iO`zISG;8IqSSu)Dk=dSBwe;<&dtD^~Y>Qyg zJo_m=8AW$CON`hFXiv6Kn&G)mIWTX*C)664YtHo~+ z-FfKh#HX7R-r1=&rLNE``cFZLU-GPGI%PGMyo4fh?L68HXIxb%e@maOw5HdV{_Yim z0B!RXHEw}F<^qp70m~QC@-dJG{P^^nP-msg_7n)(OM+~=k!||e>Q=JGVzpknYhkK3?qAr`3N4w@E zA9+C1!gcrKQ!(sa#O>}YKnM5FL}eDr9?!cB;fyFfqu*iworTG*srQaG2fm&s>7!0G zcbvpU`MSziFAC8%2pzoMPd5Z6&8`yP7EXws+;42E+>+`#^Ns1bTBOy*F8@S zdP*l-;pg+B(>}zRix*iP`soR-smxQaZL7(qv3PVB^_|FEes3ibZ@o%)ouv(};#y-q z^u-Pzi$Jn^YItI`5KXj4#{w^~4G?xL`>WD=%PZ1XZ87CxfhI-V7{dtPB_7%fZ<#Ej z+!B&TymLy*<~tAyx|>lxMU;2Ly@{&^(pXiE?7>~qg1WEL#-hOVkBf6Q2(E>cQRqsj zM_>CDI~h-PdojOlCP!)xvgC~r45#6Wt%0*4aqcAVPd$SQnra)HlYHp`#GMsfjQgVs zHKH~<#^;jqdjv@m?)O7lg7#Jh!hUP>>50G7L){vX-Kow$vKy^$XtI%od?+sV&pd?l z+cM-Fk224m@MOD%1)c^)dPs@SxD<%2UxZae~w71I_(Ok5J)VJ~HUbh_Al zk!=S0SQSCg^|mhl_&^S!B=oZT+}8|TM;!Q^m5bqLz5ULQ-Lrj5Clm|~lta;r?1*oD&9lY3+fhP_!RaB&K!t|xRt4*Gt4vMu<5hjk z1^+Xn8i7wsGak?M)h^BT=((%b)RkRbR#@!}`d!h-X^^i=1U5_XazZ<^3BVzZmovd?2& z=Vg}OK>GPy7hL?s8yJDG$(-+H@-KZ`jhR_8Un-*aAnR?%wZN@nTd9i)aL~QB^*JvN-XS3+hEh~z;1g>Y%I$)d21XP-&yjI=ZzyUGw9%m5^UUDbCqcQOZHY+~@dPUxr)x8fny;N^y z$}`>O3skd~-fABYbK2_1S$Fj76!jeH%ueJSw~43zIvcl&PfrY-#-3}q?Euto8*|j5 zCbu@|M1MRufEQ12%7f^sl2YvA@znS2nDDN%)YL_t(7i^-C8zUsgp)ZO1pV$g7H?FV33O zeC%Lz}P@8b(Ay7k-iL`$cYK5k_nzD>+grulv$lyWBq zkI(%|#Z8p?TnwPI_3a+#%OrFWXZa+4cOMTs74P}0$QhmGx#)Ox_I+^oS?R*xqtZ52i^duNtpzmD_Zj zhV7k4r+HF7me#PyJ-|BYii`EzBgY~Gu)3!OvG$7O1qk%q`l9fePT79TL*Xd$JKQo zP3*mgA7pU2{Gt^3hqB{iJ=A;JlA(V!tNPm0aC=cYHr7x8(QZ7ECUGLNIB2>i3u}{H zT&(&~|9XoSAA(MHl10I5*~?f0{u>Ur|vuv_-!`T3pjm zfn%nstF6zteY{TFEUZh-ya}h>`;4Zb^jxJai_oQ~W4Uplb*uWbDj;B)ns%M1QyZ|n zKUKRELkYV@JX<_V)F{j)3kwT-v9#S%U!}D4Ib}$0U_>L0q1*Cey0c5JI&z>>q~ZK5 z6F+5GQDRs0(eD~*zp?rXcVaDC+tH8+XE!nFB9Ocxn}X|}?iwcrXDy9G5(Jrh1Ot!a zr6F2uhFZm2VZxnMGmR5S_00xuXuylMGjdKvr<>o^+3V|i&u;7Tt}gw@%^NOJJ_chY zKb^NkuA9@j^&PuH>d2ef)f5j##%rD0KZvJ%W6!39JFi}qaBppenmmlO{2GsM>uAmG zp3fz)559|u)p5BW80Nd7$91s%S>?J|L#}9D<%>VZ%rGemFsiCUeQx{FH@*SAyt82V zX2)Ucwt!8%?3u-|upa2%tT-|<+3qt;lQwBXCorKUa@SM%7lzNK$t1rg|z={T*m-r-GA0srGwJvOJQpDwRs#QqawCWLc>DJSC@dZ8i8CUp7uKOXcIezc;oU$!!%Wbu1kg=T)jy{@#)OdygtxW$?%g%kJYY2bHDI*46c>fO{ z8yj)8{ph(#+yay=l0q?;{asN345T1fcYcp;T|u3k1F`Qe5Wd^&{7Q=1i#Lh!>MF*A zgM)~Eaw**|;g2e{OsV9m$fTSk#Hwd`9v_KErixs0mB#RpKC*`8h=g+ucVlEIkILD% zoCSy*hoE|1W+f&ERcDxN_V2)bdN25F3aZtmH}_IIgx>b+^r;?0S!f*k?>C8D1fTF< z7NdD7Yc*hjYU=6Ls~p)v5rrjCc8*?+ufIRnPYBSHQx=bF_##TrpI7oZ{we(aiG_lK z!?o(FEz&Z|z#IB9)nU*(0?18C-d!^{YBpqYAR7}+AXlV$y@A z<%txw>xc21va6ZfBo5qN+&;T~=BeJYxKrmU_>QJA#}!xc znbSZ2RjAiLWl$}a+ETA;^8GxGBNZK40nDk0^7??A;#6PcAj;C=t6mEI;Zl)*FB^Mc zgq#5_h*?#Jt=X2+{30|d74M}z|ZroI*n>k`*F&~pwGuYBZFNNo!D(X;bdwYAxe zIpu$v&;QG*V%7?tyvgJm3+np1Yt2#fD!QsPmm1oO1rV$c!TL|NK3AvjUiz(h5SWk_ z3wUlKsxDHMgPcVW1{V}GT=}VQn37$BeGiqS=~sO>IM42qnjCd4M!st;cZ3s=Z?vlr z51&nmC8_>0V#dgb*XBZ)_;BzuWN^nYHe8@PwbZ(zGM{Tx#{vvqJFE9_N~>TI${Xh{ zcPw2m3UopfORp7rz33MW{Ly|#tYATZ_*oj^f0S>P==!{hin=0+avcWO{Yp4wiALU+ zlA2N1Gg9tV?^Ue?pZ$pSA|)1PW+rAj_idX?%jc%ii9&pKfR>V~i)Qsf0&eoMY$Ku~ zwwU_(+=^m%Pu}`tJ;Nz}ET{nrx%5&&Y3Q<^z~UG(CgxcaOM`MeXJDRDqtfh;yJvd( zB>nM!9>dhm%uB>O7Sv(;jV5{0_sd+V7?9}fGE-s&TlsP-mnM~!T0ocMWKIWx}|LN*9R^TB|pkx1cR`CCYp~GuS*9$O+8kX=1 zBSVo^7rA&hwk<*W-il}}!7?%f3o%;@lF6e_oawAuXGbTf;b=0`TrSsy z1x~8=Rl)&bk9%u>W$UW59^L7+cxJ{z>h! z_&;>_N;gbW+u*c)Zr`<1icpX=uZMt~6=;)f~zC%HuIWlbSl}ANz3eCBrNzpD*u&b3p$s750g9MS`p<@3*y5)}pN zS4z;(7o_lm1=}Y(9OVSwyZ6cnsgFdaCmJ6DXS;LEtbYacj?^ZI+qsX}JPt5*7c+v7 zZt71Ie`f8*dS$<**JW5M0sHMN9_2-e&wk=$v_VP$W!IURR)(e(lYcL&KFLCMdVXJq z5VQc!hCTvMCnhD9L8Pk0CU@p;q9)rm^BV`}epi5aW{1`7L+y7%6ZAOB#25dXR~8Ll zyZ6#rV=ojHHIxEK&>f$au0s2}JQ*oWWsjrOB*@JkV zIKn;mIL!Fw#Y5MekMmsoDwWQKiR7u;z$GX1f28lwhYEOI5mKKxox}9GYYCtCp!St( zL-mD1bxh9Insh1P8ZvIEZi9#wMfamMR+5FW(B}$`AB+aOTSDf-b>?@6*EL{^BOCj# z2y25`OBNzmFh`@vM$Ss>VZRqM;Adn<8^|c5sSv5QPB(~#KVjMUI&8Y`kTXkXg8i)o6Xq9t#zS-|*1@jG&A6Y8Fzp}|H$AxV)3fw0{xb93-#g>qzt zJ7x1@KxQ`3mZ~|)d7i&lHAVpkmaK3&6{(z@VbHslBDQk>_iM%#(4#epLU47s1KM-_ z$3q+;=LwB3xMc6wB<&rpw$Lc%2t3yCj(~xJt{l3CL12eTv(O)h98M=I1EdN3WQ)(E zG+yN}MiYMX5k~6Ks1xctNin^SIP-}_quN~8#lca?d?izmcUO8GmM!W#EqZ>JNxNc2 zo?VEd;e-PI(IWP(WDR}H$LITa1nHa-12VpPcXuTgJj7sVD85=@(x9NAITXGQb$xN; z%}Lb*`;l-*v!_8s(G{?WHa2(6?`rF*%lr)hD zpi7Qru|#MOOB#RT@SgLEiIlPdFq(_g|C>fo0s^!SWsLHJ!;8Sz?~t3E^%}MyM3$#z zM64vWw~1U=W4I=4tb84y`Vy2RfxLJqvf0cTgyeDi5VYo+`$X86BkdV(QCu^#zU$jZ zJ$t4ikOR@$KYMo#Qc|tIo7Zsfd7BfB2!sksUjIYaZjS10iWXyz54+z|M5I8kdd0!w z{kTV5re+hWwFccT*HJU%xx%V-)9*$HYZrCwZ5wWrK2A(B&ijt$td4YgT8x4-u^+5F+jPp>ysHL+qx9L+zk9z!Vp}_%Xq~ zqU$~)%G7vU&J!LR+jxht_D7TGC+sGdvk)xh{Tg#V6or?N75k&0ur3hOJ_k+ft4pRS zp0yV6XLs<4>%w!6Nl|BKSZUbs#AU*SDnTKR&3&hHR6 zJC`8aSZiHsdlQNBdOpQQS?jd^_Z$9<*gA9K> z$gW2Wd(F>;23It+bd;Hl1YypajpAw~Ep#H6_}J~^;q;Smk+9h;{dl53gmHQ0RE$DX z=c!RFoHeS7*65dCMv+HXP?u9bTAAwT7wORGCOlLb%t9+GFF!%D9gyow#EcVlmPFDq zM5DMlvXrq~hg8kiT!mwO8rt7WEC8R))z&AS`b`%NBDg>3l>>q(g<(<_$!4cvOy*us zdGzFl#0P7Q&sdVeua;XsASg8RoZ&qciP-i2mU7l-I3|R;`D#hrROk~zY(04AyD?l* zG4}g#E;m1|F0bm^Ulb}k{XtKfAVazQoUsS5%tDPkNI#HIs;q1&zv%q$78?D{k%#5K z201UMR!rv9H4c7q5)Pt;r(D}opu3k1g)Up>Na%C?u`XUgK1JHbpS0IH z=p0m+*LxK{B;;GPk%w46zGLcmjUSPoo%SK{x^gMM)5oNaCKySANA!?$$v8+rpP--S zWe<(@hR#C9PKI8R^tY?i5(Qr8T|1`3W5A{WL%`1UyKiCzJ+Ld8MY(6wi{XwGn8h`_ ziPMvXvw0*d&Ge)qfsm`c<_}PY4n_3rs97HVQ6JCOGgW-({gKA)nF~q8Wx)rv*Yo9x z3}u3=JUh*9w_a~-W=5Ht0tbKAKn*^kLOdI69uc(3*ky)>m^8zUF7I}i_r{mwK@<_+ z+S*!^?M9cps12VB?`rBwwR3Q3YuVeBOLJy=1}fv3>$%;Ig&_ZhQMC0&t7CkuKh;{K zF02L5e_wDYOTcppjn<@ClhLetxeniIc_)HzX{tClpr+z^uyCAaw-dgYwoGggO@g{e zJ0G60^I_q_YTO2bdyQMoq_BD4H+TEqPBjUC%4Ar$nmKEF6x1*SIquF}$+4cp zUGerUPz0@yt*#O(uunnZB7B^BHmR?#nni4JIh+->N4yU6*Z}doz(3)$S>lrLyA1;) zVn>%Lr7C#X>(^`%NE4IjX-i7z-NiK!Y}=IQ6t&YProK*%>#F-RW5iXL(H5K6hSAMt zWo%Ryl;suFg%g^o38*Q@XlQq#hvTm?9t@3pYxhSDX($7@VhLAt;)&F_bkv7a<24XU z`Mv(QhBoHSpJS9L|AhQ&SfYQV#=g>ZxvSVQI!&H88yX(gT3%}X((SPILRSPwc7vy{ zuP-evotm2Z`1tsKlr9+Q=#2O>-5T$(LqN+Y^UXSqDqABB8P#;hnDIbJ_t^(uR5;&B z$R`>yb|Ejohg+h=+!v?jr!|4nf`=O^N5$vZ?ip)#tol?lKLb^X4gQVG_A%z7fQ5sI zjV%nhu&8!lCC?FpC)sBoNC)~0q!?BFEhL=#(Dt@3V3zvS>baz4dUi^A^@SC?_xX*s zEG33%mNyGGmH}Df!bm+rPZ}b!A##UqEh_{w)L!#9Icy>qAAB^8klW1TxIdOJ8NJCL zpPoK?aJ{Sm)YAG4cTkKPSpT`q)^}Y$l3|v;%{9j{_7}5CwrhsahRqaLf~TN;<`VFC zm0G)cw^{75;MsnUTWD#w++2#Sb>Uxc^uUVQqB)i~&2#U|e5%LTgEp5F>q7RXZ+=@h-UCTS9wkd?)ISr=RX74_;3Kp%e8Z(8|in!GS%)`s(T`XI4v9 z^-tGK80ZnPZ__GCAEzI3&cW1vV&KG#g|*tn05MK#xXBlyo#`fRGU@fhQC_=Md^+*E zAAvYWLA-0UEjCmR9(3JpLJd+bg1avlzu*@^|9PDU#50}6KFBTYsah8Lh{405}EnGo{u=B^5!;CeiQzH*;=C`ho=h!7DyFRdXTCj4!f{*|*TA zHcoS6F5tV8Jn^3o42D4y0&JA}*J%0e?s3P6YY# zj%#CjTz=$Z6FnR!<-P#7C&$EmC?+6|9(<3iO-2R=;|6ov0nrv3B3Jnf!O zYcAymdobRvtvG3fBot-Ew4{%I@@P!soS)nzCMJTJzrJ#+u-HDq&N)+4!=C=NJQb)* zW_Y)?xjodpq91)Du7Cl3{`~oIcNm*{es_0Q*bXUJv{qABUq9+U+n%6rr`lI5PqM|i zJ9a1j9u*$tQ3(hR6B$4M+9%A^sKEh`PKK=8(1Dg|q6((GFM1qj=y$yiL|U+iP~Cdb zMglEZqHnQFOG^^L$(>&^$YV=dT0R9{&xU~LI*$Xeqps_ao{WLwc>(YHC;`%PG0qR} z#^B9Txk&=$lsD!zHm(cbss*VIDW(*0n!Q+yzBH#Dt*rbe;)~AwSaLLFtK?Bx~Zlu`P+K*PU5Myzk= zYcDF6$ioC2N7CPh2@+z0NDQ=TMVXM_&C6JD#Wxl|>_np-UvZ!I#`RQ+C}R_vgno)F zYXYLY`yCfpeAm6OxEBt;aNIzz?tD~-fvdOW7v$F161THphzYOpC!k4X+pJ2vlz|Dv zH}LuD_F~w?dJ;-9iCY_NP#x<8^CX~T@~E1acU%+e(RG6mw2t1P8lhjD3Q8S+$KL+? zu;lc~eBTc`KR#vHPW{=eXsti0C!XE^JdFO$g{r{f%I_5q8PDhW#9Xu&E^0Ie z?m?ZK@+cF&gS(gY??Ft0{vHT73!6c6ztaVr z+9Jv$nvxU@-Jnf?#M!S*y!vR0j8OnpO;M@s9{(~Ym;I>?Cq}C*1?+!Z9 zYt7eOKgCHBJW`D3s(Ar721UjpQ~VXyX#=-vkQQe4k_XN8m9_=FDFJ8>7ho3K{E}aB z(fO25*fBIHrck$mI$HKB)E}{yJkiC%Nrcj?@B5%GMiZx+jLQxh4vq4DawNI%<>Thk zk?Z=?$?z^LBEl6rS%}(&8*_doD&N9Xx-@_J>X<@(_<$F>r!f7KYLBXxzyd8Xv9+r! z`4QR(pxscPzta|YPQ&ko1pD#=JzXmHJY!j3-_k)pG(RIi-mS_wGCm$UfHrzMsqd?; zo!~Gsx&fYdAFryXV*}mYjb0SvBEe27c<7_?)-D^(Ub2f$*s=@ZO+>Ui&A9g?9pFAk zNaw~MTjj$}6tfH@00&vGr7`xq$@w-Mqw8H^XqPRCE9xC}Z81qxRhctMI9TC&Xd1d@lv(@ap09 zR}E-`pT9&!nm?Ed6Gs0b_!7B_t&)%w;~c6;k_2Qf7QG>E>qkbCRT6qZv2ciU*C08t zByl^;)P)KZV6vG~iF3#dM0XZABI=bL7O-c~yO`?p8w>Y~Kv%mTNREj+4#yIDvrBD+ zdIrA*64Qv1P`pRf-0o&jQ@}6jvZyfpZ!2f*B4zBjK*Dh8x}p^a(KsAjJWTSLWWWe5 z#bqp@%H@fybo+SiWF?6&;=7X_^dWcFs)^5o2d_}FhGv{8X|cZC5J7&cVmQZch=MdT z1@UMi9uW#nqP+t>>m*KUu1cO`83(gX{krdUUHa{GdTOa0Qh2_ic_pu__XhO+FKE## zivtQ*F0nDsqm?sHG=;pnLkD8A0m<#zJd$cp8Ro||aI(0K{;y+Sa_j*#woZDpC#TKF z`A=s$RP%~i<9~zcj^~_M+Z66q@L8*KaQ^0t%W+z1vMpj-TcV+IGc@V)rYYi+$9+5y zxUg}TnbfiI(WD~-qXryuy$L9s?!?A>a5RmQJ?+HrRI(r;9ND^Kk91n4Jem|nIZrCI zeqKFe1@}Me?CIK(4Yywl-+7reyp8kdhZWGCEkQl;L1T*A27~A_(;Q0gYM*vnb@cR{ z8l2Dh@y}}jsImBRvRkF=_qY!3d zf3W=<{}EZrZ64ni6CD(2aB^ z$?DQZeKyA8o4`3x_FS--nu+I9iVlEgfsR8XeOKi3F@-%>J8>J5(q$i2x$Erwr(5Ld zridX$WI#IVE}{4QSrZ`z_cdwbRmZggah6KAOBeHX{C~pFrWhP<&nvcgRYmtgupLkF zr74rX32JU%o*xxpVuB}kn_!|+5$n{3&ArVs)(%r-v(aZ zDzBu2-`vE0XJt;7)S18lNF-Oyw<_bHC_0t+WQ1F<_TGX9D@-~t+@>6l#T9GXYic}v zeRv3aZ%uKs0O<8fu<)=(10C=Xc4%d0qh_k9qwCNeP`O>wv7oiaz;7$RhF>ugA0A|< zVOBhP$bqlRxSaPT|5k6s8@_4T|Ill#OY+-7fZ8&9tC+sr4F5Oti(nqQTaT}djpF@r zNzN9(^6K>6+0I5h?!E7u9ye10>CK6uJYJ&#>)Wf6b)KT*{ucL}pHc+Q1oGKp>YIOg z@9{H<4!ek!-A%W8aX;pAQB8`XURHHObsUnmpWEr#00MTFZw1Liu96Lxfsh8tuX@}K z_#Grfjt73SR6ewF8boSh5{}F9U~{G9az64@mdZhSes{=enH{W8{-?>X(lJcTG+{)s zCtV1wO!&mi#LBjf;SSapE3$#%8cM47L@LvmzW5AiMd(Dq;Rv{@4Hzt1-_9XFUOvKt z!8SFElXtRPduDrR;W^ddt>6N+YkBF+!4XLCx=EjzT2e3TrHpb`Dg26#t?i1q$BenU z% z-(1I$?e76nW5x{;-3J<}mZYyHxO)FIuYikc)pZDudIKVkYmZaAHu4wec&xRogG5Z1 z?hG&6unL=3hbjffGedxfHT1I=Dgp(VN^=-jSEy$#TcIbF5=*~7D$yJ_Z9`5D#Meso z{dh=Cy-cgerrg3Sft6G!+*{4IQM%roxtDtP{K_AF;RBTU+5kMSO=#m&%Sp(f0th0p z5;6MxVb(D$n4y7h_8n2bezhJ(Cqt1Yq9!ykUon@M?-QZO*In5@)*ygq3zL#wuw!Nk zA@1Em3r_)ue|@yk11ZMR!RA(bp{n!efJ->V6}Jh}N(qT?3U#`+V^`?&dCfJgt#z#t z3HT^qyOj)AeJ?7t0)>=d@kj}M7k!D15OAY2=d#=V#V)W}{s-615^g>XkM%Nh$E|>P zU+wYwaD#6QPLvf7WCJ;5>k;@u^6#nu74pX(&+6U|J1f3(&X$yQXh(yQl&L6xU-4hi z&1FU`+wb>hai&GxGbaprMiSpQz6j$gQiOqw{;F4UZdJQSp68m(2cj#9JX( zLFO$VlOj%}Jy;6dXa+yhO24{4+-kVvJ=78dBYLYpnq1Hm+UW;ZSy`#DZblJ$a{7AO z!OKbyr+%Hn6km4Xiy~KSf-9A&b99Z*XYfi+@VxyE^14<>KHaLiu;kF-poHb>>@?Dx z(qPkl@_B%daidY~d5=h3E2L7w%5T)cL!#5Q^7fQ!wesjSMWoy05P*rg?Er^qC&2TyfZOfe@vl2?A?KkHlOry5j;}k|8z_&Bd5_%lmyK=xhc~all zh}rJ&Sn&IW;d0dZfi+z;#64N}v*@yZ_>zId)xtZNR|PX|F`-v+Z#2EO#Gu3=S87dE zA>)~%n!=C#@>8Xx_X)a;0MosXbJ)wARWbFS$I$F5dD2!58T2T+k}RieQ1Gn88;zWC z7qslw!_H3YkMhhc2NH=ES;rth7@YJfV>QBB76;x|>WsYyq}jyTP8oScIDZ-W=*J+n zTi`S4e^Y1z>&wd6{>mg}IR_f((ciIUN=H@3d2Ai8Hf7rQH6Bou+al^ih&$V94YzE=m2TmVWv^pe$O6wh)sw4XLtmjZV*> zZLw?z>z(*7d=4WT!O6O^t@?%Y%wazQyatSxE>gsy@y8yJoB#L{(B&LL^PGiW%bZD`&0_fei= zw<)pvEg8nx7){b*hO2?msrH8R_CH_0ZDgKg&EU1v76@JB@l7iEb12#%S?JYsT>|&a z9b;(^569&McLjy^Syj+bnKxBr6=k~8P@rui9ulNlMqB1JaT6~7j>sC8k)XLg#qdRY zDldN%^v+7uiguVa4*2ToA~;xvL4j$iB|0P2aBjhj^=G1Hflufcw{ru6VZKUJT%|f; z<4u7fUg8^PHb>V)*PeO+b-qDK3Cn=sz}v|(K7CL&r1ClUPI~Ei1+-IrL^YLXH@&F| zhb|lO@HVypgRajXY%@YaH)pqnO2qgcPlJ!<2h# zA%7zulJs#kOg70Gwm;osEk4{5s)d_2qHL10D%x@qakOF_rE%H3uNBePA+}RQ~|2NpmjxEbf1yD_x=X>;al!^)tL-Q9s=bayVmU+ z%W`E+?qBmiFyFtA7I*)=Hq!!MbPyvLy)Uu{1O;{UCy#-RtKm?Wc8Sv4J<(A8?2@ED zrSf0fb)@#CH(pTQ=t||I1>P>oY1RH-UMzbhml7YW8Q02+Ky6BGN=$IIzI@u#;{J)Q zm_#aM(7A%41{bp_=?mzQ*d;7?ToyOZsFp6r=0*6UoWIHoC@9^GC*6wWe_nOTL6 z1%4b^qiY|DU@qJt>u|aUlX`lEnO{CGqoUkE#QFIQ9v95j21ay2R6Rp>O;t-e}YG=$SsN~G{6*Z`R zTBLhl@1|{qR)mt#cRZQ`dCecF*KW+SRANJD)wy++s&vQ%9IHD_@&v-jNG?{Q;2w%9 z3e|B_m;www+$)2VUc6hL>WZ$3Jf|xQqL!&+80|g8J+a-G^rgc@8&zF(U4UHsEw72PRb(Q30Hp6-?l?!X%sdM#&Gm%iBT5~mVz7xS zu(pi-kjye1>eS%e=HguS6k5zEMCv^(Q%Gm4Z_h7g&cK*BstE8x9(7I|Udao@OfSks z!(dj0Xg96Q^cqGzH-B5ZiccKTl|xKMZYpa(+gM62r$+^u(k>?B3n$wH!7Y)>fts80; zy(>eXe^nGvV{mwBsZey@Uv&^TOemUVG#q?0@?rb&8V_Uia$NsVT5%~;)Von}+I_D| zw=s1P%8HhIt!onhzgSr@QPLv zavVJS2(V=UI9BzQZjJBSKdmHu#mPv;Ybfz}pYT`$*RDQ4K)lJ^sO!ent|KBbuya>= z(_kTQal5H1m8O3X6&2q%4<)F2Eq#jRq^@@6;;BcbB1crXYsFJ*_)yoeRMH(8fB0L* z@&2smz%DnSS_@@^iS6c3wZnS+gAYwr;9&W2`n;_);t)7_QrS_B{wZ(EJ0OM@h+#;p z!bEFYqr4~TF+N`+gRNjR3X~CVMO^TyVPB;=QBQK3C?^JYl%p@Z{+Vkb! zaKXVAJ2~afb|OuM|63kXt=b#Cq*U}LfgVMW$x1O0sq<20vO`z?)KT3rvh3iM?lyGx zxHQ#DO%+H$*Ta;oyE$$LHO81eG1Q)WK&lrb4=87BF0H4D$@j8=1^c$Yw^rJ~wqX9V zM~~Wq1u8Evcujc4(Z=|sUO1mBTNkOoN{Qp?;jHywMcx>n^OQWXZ0O3LK~i)5%@$g> zG*|pe_Jbx!*Q{$|2+e#Z2_uu+J@5%w?6%jb6{HpureJQqTe#7t-+f|YeE+fHP=Mi< zzwJTcw#8^0DiAlfnH-yj{5NK7>etj&ME=!FOENtw5NI4#KCJ>$i7l-dg)eHREcu~2 zt@Sk3(Q5H|e>Bm7DN8GuZvVCR`mk5|`z)S@aA}EV5bC zPGtNLl#4poB$fB4=!T{&esZU)8F9($Lgc(=Yg#SVC@6zRr?LcnGWQfo3GXdAoA|%_ zfi_!Z4f|>*i%xvWObpFzZ0u51=I||eWgK?r32Y&(dJyNbp*P@(16)l~vB|l6wWtHP z#FOa6qUVdDm%947$rfz_P6ue5H|P}XgVk!p{l%Bb^dUxC_NXOcq>Y7BPC@E4!S<~w zv2^4bylo$gfC%{OWQir29Js54E+s6ZmEx3%Y+w#9&hY9}JX~c_cXnRxGD*|d`l?mj z)f<7bY}UPf)n?4n8?2}8A^QdfV!BpqaTrIruz^M))#Bx(+*7ZsCHaZ@eli;1wv)3r zSeZB%(A_#NikEg^{py$wc_{z;i4*E>dyb-OvK6+Kb#}VGz3RfwDTZ8RMT76>Ji%6@ z%4HIcdqO4>(2$wDmqyFk{0gxT<%#6D>h6dzlxWskCW<8I!Gr8-RkqKT$Y(Dhb!ece znY0ls{b)Pe>`|E%56kp4XHuI>gbm7tCk%!r+I2#fO(Q8liChyXqp8IGjK!~_{nyDh z=I>nS`qQi(zQiFl0zwenL-!{M$M6ovlF+~5u(JQ9-!P+fwZ<2Wo%29Twr0NOv~;F& z9e;@tO0ed+3(x-}aFDfRK~peeDs2|E;J7n!`gL(sdwF;-ivPXpeuJ91yoQ?Qtf(&O z$<@)U4Zp{qPQDgbVlE;u;}{Ow%Z_w?k&Bmo^v+;|T9l@DVvM!4SVfzw&RDmG`$ox% zv&u@``lFK|WBj??Q*>^W=vZ}9iyDSIjXJ)3A>Ux7u23n1%Qf=Z{HuD=heX=dY zO+PFTgoBZLH~j@NKdVsTAZMcujg5@r<8V#1!CfDbvM zUAhJbD0hIjBYyanCP$1{*$smzzi>y_YPIdO8Tw#qf_IufEkYOG!lE>F%w?E5eY8DJ`-T|yfOkhPoa;!Oet5$8mc{{86kU3WP!9Ss}} zPuhcSJv1$#+=wWDx0OGkYotxD%baDckdsAe*B$nx2TX%>PCvRB)<~dI(R-HP;K`On zI>14yBrT5ybn0UJz`qzYOn0Jbk3P!h5ZH0ajYN9hCPMEyd4{;D#F73^Zr}7BD@-@Y zfp2Ed4QpinX_9ETb{5*K4~L^qrWZBZPy1sd$$~<#{0(QWO8=PcUNiHWGqF%ZLGmmZ zQo`>|&CVAA@*QAbShyDN$zJbRvVt5N-B+w4KefQ73~aH!!bGy#Oqw{F?#;Fg0NP9)In_@-CasqmOeZhX!;zA)SUnb5KxrlGGOVgwb z*?>Fb^0Hb(?Q@(j=@)gp?T01pTXK#3SFd5plft>S7{?3fgPAo@^2c}w5^QBPbjaNW zsh{keBTYBTLK!k_tR~l-Fu#sC6qq$C;KiaVO+AtUJbUWtc6+KLsTYVQ^@(CYT6^oU zJyWw{pPQc5AJ1#sw%yqD55Cl>jbcuEDHCHam5s`p=i?B9g~@q$-)VJwKSQ%;&l=q2Uj-yrwNz#CLdSVcd~>RpmYbgIy& z=u&I=3c7~R@x_33u0`lrk&!>y!Ho9Z7@9BU zz>**1{C|5o3@R(@4Tx7(K5*U{9efh9#>fchPzWZn!x8x_062gR$F@~Zh`2JVw#jIqm_lek(M- zzP+=1>D1`tTxa00>T(0R+{4s&TUu%P&hU)1n(BK?^e^rRQ+|6J=19r#C~T!wd^^b3cOY0BP$V7Z??N4!sRq9^a;bY@}|Tx|3PM zuuPyNT0NmGg&XCME)LzYmhWNk=Rdd^h8)PSfNo?U;bvnwpFDvW4#T#A$V1=+#`HUK1kvvNf^z z!~O9}o01%ejMOtXQU}CQHb#6U-Y|bDu^VmkZ-BjQ0DH}t@1J^7; z2DQq?`n@ks!i95$zBd(e+5*f;VQ4vBPuu<}3go`PwVk1i(;`%l*5$!vcv{*bTRVO^ zq#%xk0qpR}h_Ie|2Lrr=5 zjY+|jQ;}?l6VPd{@siKi7)9lIPH(PRMxP-+tcd=uRY%%eK#Tbabm7^>S#y`=cfCZihZOfR2{V%OM@+e59Eoiwl- zOlj8%n-gU{A~}j0>tt>Pj1nWG{Ch&nT2ACvu}O7vaiDcIjT)_{nWJ!urImP4(y}M6 zv@8SmF+nK_+O?DA!7y9<`Px9 zAnE|4)JNq&pPJ9tl}uX_mvnVWcK55oZ*+m03(Gqu4xy}B+Ep~)Le>Qemb|E^!zhVkin+2VE99oajt4IT2$y;{s# zrf%pA0SU9wKfl(Nm#|uzWw)Vkb$b?7UzT%8<4Vrt2))sGX?W`+IGa5+7fMy+F0V|- zAt<+Cx;z+omPqaem!#}r{96SE$jF{JwmV1>s@kWu~ePE^|*@><&R5qD0P|UVBQW}_D{`yR$&?2Krb6~x((6t ziDo8=;U1y_o4G!mUrpNE5dt(oyYLINI=yK#E&5bSaRdp|1~VAHiG_B2j1+i0WyBSJB|3=2aI3Mz2$&-~Q#!Dj7awAV)#bM!Nf z;u6RD`~YR~JmKAHUkv@RQpWHp1$Qdk>afK!LqmY1FpGaJq@VDoX1@_P$sNkzry)bu z@!q(MblpJ&9%@x}HFX^PB(*LL+8{*`O0S13Xlk4v-uyAhr-4IHVA)+`a6ogC4ewyf zx2vBVl~(-|105X#YlvsoY|p+}{h>Uu;?lE!Sx{?w>&p~7gp4mCO*W#=r5-o0>{F@uJ3Y+Ljh>YW>MqFF9U2{fY@>UiXyr4OA@VEKJMyddL`AVV z*BZP?-8UvIGya-dPWktib5W$SZ;M=%T_`c4p(!N*>+XHg_ctr<<;F{oEt7>KbwOze z7rs`*A&lN1%-y0)bQ5A@d5Mu)7 zwIh!aY#ML=%pyx56J0>f%*7w?a|1#z(J?`jU%Z$;xe-43C#IaoqXJ$Go%w1wAF2&! z;)b-Y>=@3m5!HEE2JMWrUVJo`xZ*%SFr^e-S;uiY$bPcXbk;!8n;waOm}}ORpl|h3 z(v+1Qa}a#mwH4Mk1GIivL3qHJBO$S z8J`uxj5-jRBG>+a6m)c1*6FPI@&3gt2%56fGHqN|Gp=;NPAX+ zchb41%lb4dEi){BF`J9*B*i7iPu+~EqZhv!g!tAd6<-8gjY zM=`yeRziPOV-T2XOs0*Vwy4Qt$c%%Ov?Hbb(%SV#ZwN~unssu{QL{l(Q%nd#r>WOR z+Q1%Ye~x;wI! zF)jF%4*b^mdYVN&b%3&o>k!JTJJO9f+Wd~|^lD&Th;!v> z9l^&_;1>)lA~}n$x;LTkARr;L@LH6GR+rEX7hRqPTMqC$pIBPr#OrA{$>AiXfR2U+ z3nrmt`OGs;-rM8s3Y$DGbhUZWEeFIuli>bL$O-yB+HJQ8@<{(-xQMa4Ohel%dCuB? zx!hVc=fT_NBE@6>W!EB-U}q1CP=oy}J2Nc;_Iyd9Trj`YqxJ6juIg2- zvOJAROD13bk0K$`^ii(YAg-EY5kN-k+(VnlTE(9~-R_MOyt}g4~8v?<5 zSEM^|aJ5&&E=(C$c7P`jk3a0~p`hP+%sf(n|5TAYgHZGc)F(^>N2b=@LX~#%h8IhD zy&klAFD0(oIXXm}jia_Pl@yHxy^!G_EHgsY8)~_YAW^haN}%Lsl(r;UL53cEj8)e@(yn=NmWWe)4wagS{r`u`)*gp-;=~(+8Yzw2Nu@^Qcw1MB4bXY~lLXk%!Tnkw!fb%w9 z@g__h*FiN0Mlez!@e=N;kbZnBL4Qg|-K(UQwbM?!xap5ooR=q*fue++c32DTAQ;{n2GfL4KYF zB)e*Z%21jkYwh{Pl2qmvqS~QnE)@Ym9xH?upc`jHxz}VjvxFhCyY8ZzFTHkSjeFaj z_Y&KQ$xvYX)i}7qx5~McD--$9mdg zyHAQfMe}(nO4D3oj=XWf-a(0ZJj$Mn zb;E^qR7a#H^*3*WNex-bo-0?D`UynD3GU%@Meal2V-&*r(g9lqXe?%5i3|q%Z3G$_-XuBWs<(%S684AOqHX2P@ zK9>|apy{MXbC#rYbqt$Eox^t3mI0ruU8$r()qN>%tA}cD1Ib>w!K#edZ^o}4_D=<1 zD(B2W$+)voCLGT-sGB)GkJ+No+rF}W4!JJw@MMR93 z?F#`7X3-TfE1p|&vut)lrmC$vSSEuvohgBq)L`z~2*pty@?G|4U~li~qxtva2uH1R z#?_qbRdXC74r!JMjkTs19b)jaS=SpDSG4&S$S@yChsq62hglaaUOvM~|Nf+6y3)_N z7W^N?us27(w;l=o6pe-7P1*`&i zfLN0x>9RLDP@XjN+TLwxLLI_3`DNlDf~%pIf|tY9e%Qajc8_R(HB7+tIiC0T`~RXO zFv|o54#R)+^HUJygK5Ty;4X0ti?FCv^mMIdZO$57ZD|#-C;!+zS-gt zG~CcD;@0;sN}bAGa8(PnCRMZTA+TZ~|AHa+5)WcM?P` z**`fz!*eNjnG6=^UT#m1%)OMVCi~*y$$2ottmn@zHx?Pfjsb7|L(R(tio`$xSLFrh z2iG|)h@Lz44Xz@0lJz~RJ$w&^7mOj=8(Y#qa&XQ2gi50SH~LYY0$2l-X3; znu~+zl;W{*v$AntwErMwQdJlXJeQQdw&dY?Pnyjgt zyU!FwW`EPseZc72ISIf(vOFtG?2QnHu&S)$#>ZO?{H|QvnLeVm!RcXL_}Qy*W?SZ+ zro|Ab!cjL3Kf8rV!nUP;q^k&_dU?ErM-DMBSKp zzP*e99YUU||AR#-d-_-i%3TvX$j~y>2Ds`Yyz=2R&gdaBqsgZ;dCs{MYfk$hlBA{g zW3`?$j?Bv*Mww$F=oXqDhY4cf4LJj|A=73(=(J@mV^#Co;7nPM=4By9YJ;H&Ue8|W zZ^X-V`-UaG(C4I&KYw{{J?Zu(gT-om70p8SL&kgJ%M3;6<`>7w_d+tb*IW>m8I#kF zTnu)+x0Hu6_Vp1A4iDgEd9BwmpvSBbzF>T~mN4BkG<{Qc5dRB{N} z{#brQ^3+;N-V<8=G2$}K0%1m^L;b%j@e;XB=IR+1MWWxO`AHbC6p)$`aJ~3J32VGE zKnYL+etvS_3!aGAMEzEa4L>ZBDRQH#mhG20q=4w@{Sr1A6#ph0smj>lhBsNu&8ba0`lu4W!x~d$UcSgUb)rkuf4by#)`{|3i^%V| zDSRe@QE4ppo~&z!n2t{I<>im{B+btS9_=Zgc050`KP49JPzbxPSLJLhBERT5)nhjk z3=!DniwbV-!dw~_MAaMZ7fZ^JC@7#ekABGH+=8~YuBrv3?a<_nY5ShAa@(Ik9^URt z4U@(OVE&;quqs5;5dVPXD=IR|_l`NZ^-w>aUpEv9?xzA0@}WYn{`ZfntG|RzX|OT@|7bD)-yHj_!}4bAS6N~W9oqkwW)p^;F0?LpcZ=Nbaew^? zI@R{|i>Jj4U#HPmp!>a7t!n=Zmdn!9YWV)H>1s*TiiT8hb7&7A2OrPSvm*w?1I=-XtS%ApWVq;PrYeVGR9bG48CsE$Ye{bp<247=#vW1~a zBTJI-C?t-`nK{1sW^-`~wyeFl^M;)B!BT)=#g6_n(HAu!6%}h(&~x7jzoy3$j;@tp z^aM>_*1W`CiNl>HoA>iD)&jkrEHxcd)AF{$a7RJzO4wE88A75SPr;(@lq^6A<{v0m ze{L>y+m{bOr7`_O6~nR)PEL!vkS!Mlp7@NIsA{6rsF`!*vTvNARNivs@jp!OhB9)e zqz0vp0MjI&7@U24SS}H|bL%Y3#rs{6R^-3k;-KE%A>=BDTo-h(@w4%)!HP2Fn8Cn! zIeWCx1B@O(ZGrFvK94=S?WPP1P%n<(Wm!_pAz2>I5=PxRFS;-^i^JV|DAFqN+AV0sD z@YtF}d~Z`>sALSEQ>eucc;uIAJ~G4`*DUw=re)Yfo8Z29D2OSjt{zlJ399e%xb=id z{?mj1(Oc-D=UK)1>%r45{clMHpVJak2cthJ)z5&}O^Rmz4^_rFgd6>TK1eEb_XB7$ z1D5d#CPTqcPN>BV|9aPL1k=-V^rK5xB-0=}4FhI$Ahsz07b6u4$694=$n*RkS+S5F zw8z=Q<98$FjN!3hQ(eg)A$fluBel60*=Jn&)L_Nq3~(OAmdi;pS((Jt#ogm;gA%1N zOFXDJhN5D=SSTop8aU#~5p%x9NBdN2N3K_QzHa*-n5@}9_kWC2;hyNcZAS`m-}Nt4 zSg7miLqntVjGwTOvspCK(=w%X^Si;IMl zPT!z4|HVju*Cm1S1m)%eb`hfksjq;o7gGOoIMN`POAn0fg`_VwbuW1Q8`LLiaAjpV ztdDybVz(2&4!A^zd0ko2{KY7$5NW?32S!;7U$$fX7#O7)`QOgkBkgs({U4YAWuNr$ z(;b-CwLS!{{_gLGF@UJB>99&2(OgMsvf8*`N=nKAlLCt9kdn^h`0>*x)Bxp0SZG)^ zhp_i&s~@JA&W0s|!_LA=hZ;LbQNSMIZ^Y;fyM*cg(=ojuGX4Gdv!k_|yrd+G01lAk zr_ge08zN%S^k3?YAYJK=QrP6T&z3@u-=8f7ED|zelrl3j4Gj%*$PqQLHL|$PY5)6L z|95gDA^GfW%^yxgZ;`A;s^ojt1Cc09RNdU%`a)jM!q0{Xa_Yfe+UoBbz*7qDX-0)* zwe}&>QmGxn&Tl7np*#slFjh|ZqQfpm`X_PI+?1MQFAcpfnKuuV zmwOzZI`s7e3yq5UBpWQ>8kWH9jRX_r!9I^Z1+U3ju_gAfY$ScDbI)-2JtU7=-Fu*r z{-n*Rkv$v9dE zwCu_%CX7nmG>Y|Z{{T}94p~$_Pco7g!uo&Y^N)L>pA=qvh0Dj3@XphcXWmCWefT1`+x`{ceSUU zU%uUkYz$>9)t``q1ECKE*a=>s7r^7p!J{wK{}Wcj(kT0df2?X7h)`U9EM=-lmTg&J zMea#b{JBaW65KH}%;u$6wYBj!SLmFD#+z5?A<%Z3+@<5PfyLLa!)%IAZ?W)l5iP2g zVEnz6g%$$++a*5pqnU1hf00;Zv$Tgw$>^@oRhXB_jGR4JcJWy$yx#PS=OPQ_Dd2wB zqidzziC^;iJ!F^Vu>UBBA4%h(`lMm_*eU5`lx%)`NW4IyLXY%2>-Y(d%1dzga{xFRK1|Nc8pO6w9n>B3Ym1|2 z@q3kuCDEBK{*3*UH(k}P?A9K=4s}d91@XGHp7LQiE7-b!xy}%5yN^!cavO#WMXxf! zLXQbzm{-cXmm|4ajKiz;FZ$j22pZRJUSjWlH#BKz*SgE4VVBrcH(Nivw+Zb+*VE*( zSxEepqIy)x9+>ZTJagMST71Qk95`7!ML5rwm=E1I7MT-T;p+TN>wTxNKcQE1goY-V zKVRu4OtsZ|@(ZPhQGT*|xVhSCu;!KA-8p%*UB;rOGUPtQ zX<(mr2cefvhe4D6Jp3V4r$)87Z{%GEZ7!QRJT=Nb#|!Iug|uWT^0D$oWFj-yo<43g z^=4hAG6PMW*y*icme6gd)f^O56@ag#EqH5xjv%Ztb^4Z%ixzayrvoHWN*|_pTN&cT zWxtmxz)vu%ZGOM(J+*>`fsvVjQyhK5%k3KZ@Y>o23uA)b__kwgO!wH$ll`Jtak=wg zoq9B3RKvR?c`b349d$FTjOz*x-crw@5SDem7_7CE2;iDR3Ne|$$myQ%MC$!Dmw$A~5F{|r zk`7Zb3GPL^w5ffOcn$;#Y40XBO4|LD=InT^F7jV#_iuHVbcdB9LnKIl$w=5bp|Rf` zl;ygZtJW!@R#Bap3zpvaT$PO!9^QLUGH~mdATPraz`@V|upgSYu+TbrXmbRfDwNAg z)=S9dwjDeU;+G0)(xH^B`{rO~^2g50zT-9~IX?b|)nTk_D7p+~%&xDlL~AI>H0TVn z@Xz;o;TRLeKmt~^9WQa-EOWy{mJz!Y(fhebHjWow1N-kvtjzuzA?c6^}nqt3& zp0woCSo~RskI6VDw#?~lElAQ-1+DVib0E@s!nP~0#hsoyl{}s4$Oqm$99GQ?HjUD^ z!2lX~;`A@+G{5DZFrT|p4IFZ#iD3Q)umu~-#lh;=e7fZH&9{4s#{huel?N|Rl}^)} z=uRjGTscZP2JFVv|K3=l-2Gk#s&#J#xhNxENJz-qT}PBA<#M8P8$`#{>!zA`uTyIC^$1nHBz#hKOOTVL28?%J*VErIJxRI#mY%}K!dh49+4}Q=2MrBvgO@I%d;KvG=Az{P0j)`C zs&hkEQBhG#>k}rjLD5EmR$!_>`sjc8qC~)ajr{%J!0K;)FD)026Fl4r^3tK9A!&K}koCZ7hwZr=rxEe|8X^cJjQCc)bqK3$ok|)QV9Bc* zw`zU0)YII0>9fkpT-vnwf^72@?QBl#r!5&78SE9LK06W2&S-^U=-g@r(WJy;?2V%2O<8iqgNzC2c+!zIBGv4D$MknTK zv{`~!QZBa#M0#Bx?}nkK3lKQRlJMHvVNuRkc!5z0OWelilv} zTW!qY1zYPA5^mcP?afo42QJ}}z7eEovPF^THTZD1mG+81-Q0F=x^{e0v(q!C9O{>z zRq3=Gh3%1*l|%i}ajvcfXZ3t(kjCz|pI&2Rb4;+q#*>9wwCl{FBw2+H>p3|90MIy< z13ubCuVvy=z~(-7GcAhmG{ff}T3G2g;SV&9a2Q&R`^if}`}IM8*yMp%KFU&s?6nj8OB0-GDz_03Jg6&6}5EkTm}(p;y2 z+SsGBtb=yN1X+87FG-8*j0Ce)S$?shyXAUv=8gIbLit<=c*`nlw>f#A1Rswr$`nUk z{M0C!E6U41g%}IbGKj;hAvR14%+1X63wAExji-L1 za&W!U`1Nbh*KpcL=#fd$=C(DQ*Nx(w!r4mMOa1ny;9*;dFQZiN9bN$K+9$b_JM@B* zJpP~7Azwo(!<1NL(}Y;~xnH10DZJc0jp>iDpfBO)Ra z>TFhPKWOACsEl`9>A!E{y<6D8`Kmj*v1ihMeE>M_Oud>A0O4_*)CP(}b8DTxa=W`E zuO(z8YPLwp8?^uQWv{I@0K!a?Y1z>5Q1#iyn0;>oD$17d%tDIxcJv6Rb%pqWKtW!% zSTNq~<-mx~6JjKpVDVbckGdaI(nvR1GrkUM@$PY1I!mSvzX{m^6cn!^PYdxHv}5!3 zHb%7vf)rrdF(r8xFsHSvf~KYBBg#{Usc!C*yVt#EByrwdexvso`v`q}QS+Lte6y$b z)w2PQ$W3`Fz7vpxn#rnUg-_8VcxL#Z)@($ht~b0NpH$mi$n+vX*N<&Lp4`zn8M7Q{ zgJ6SZqbMC}EZ}jmy-;h83I4#(pLSwbGiRC80^2oN!d$BUV;m*!Vkpufq#9^booUJe zbKC+hDsWt7`Kj%SB~^j~^T*VbW=VlN4oWC12}u)e0qo1$9!K=#BSJR(T8i@3MTc4< znJJ~jha(-HraR?1Qo&EO^sctR9~lOpL)gB!B;AAX_~-rS*L46TD@~q0yP9jtAyX)l z^8hdVj}$j8?{a*v;`2RRCji^oxiOww6ZzLPJqav(wn>r@MR^dnp!G*(>1797F21wtRYi8E|C! z&v6aglbpbN6j5$B#RYdA-{o`5MF>|P@bNr8cXD#b&)T%`AevO@*zMzsrqRdf8;f5l z3qP6F)#X##1V4^jUfeSv0Cswf9RD2jZe=_wp#=pI=9KZvx(gXwbIPaz^H_)6)Yd>+ z{A%*V->BNZXQkq6V{1&9y>sCK{RE1agz?7((X6(T(Ot8V#wI36j*<}`x^K@Xz&vfaV>f|FH{hT*b zbVY8wn@P|Zr&$0Z7R_zBIuez*Yrshq|9$Hy3ehYX9-m0hZiD_%>=3&osjLT5e9!oK zHrN>mN0j#rE{3dJu0#KDDTYA3N^Jy9D7baSox@hKhBhcg&`QhDMEav3WB?bF_s2Jb zKPK`jD#W8(wG<%cA;bbm{>Q`LGJhW0bT?dL!xOSnfw!UQXk~kyr{fbUMW9>3oEUf> zxm+5?@8)LzS9{m}))kIv@An%h3PQN$x{c@>3L*>Om#gd7o+!>nz;P#)R(ydh&ORaX4H-f$u!&9s(mT!h;mHF59N(G@45B(J$D4W1)=9Qs6&DShkx6mF8J7H6P-(cHp3i-{fgIsV!{)Nki#+1+PD@}jRT%KD?ec)JBcG*@Uuv$mI>>5?Trye~2 z@F4Zqor)SDX2w}AEax}qPw!d2sV|Vc2h^{S32RA)2rrj$ zdZdesMNI1r*Yy+#S~yuCxP6G$5UeZi*&IEKe%9J|Pf&&P^h9rcs(u|qYh$%E;&wEU zwS-z3cs;|(R^f*6+s2=6Y=|??HEs5fR`actZd{+Tsns0Hzsy!rf#hF_4jx60UQ?^c z9ry^9aXd|MO>M-4{dhhr9R+p!z0?k4(A0X{zRG#>er8??fB0FCOhz+5Y2iIB(5Aws zLoW2VS6PF#Si-|xoQoS_qwzIh0eh1oUwd1YNcm3OEB#*O>iq%{KuOKr-1MgpP!^e< za7eFNuI+g3PazT>U%}_m@I6r|fKcw9^$ z3kEWT2;tCt34+*LNp|Px1oZa}$q+?l`M^5p!-rqLFU1dElod*tpR%6ZaoWlwUG4pm z?2%fj<(<;Av_-Y+(kgAXl&ZYD=V}OX)#60Ab6Ef-xph+FBbgF@C7SUW%G;8)oC!7r zw}{$j)Pn+B;Wy1e?nCpXW~vWzsXFouk|Gig(hE-KzctCo>n>Ykj?`0C-A1dS(+#%A-JR;VX(7oU(ugZ=+-5&FK& zzvY#APj~lw2z5kP-{7E#fPksUNJXgw%mwSIcK1LUssro*k^AIW_b;>WR9{$1K=kRx7cC!0+*l;NKfpx(IS5b!lYo z=(-XJH@Fsa?8pC*f3WLd)c;LOlV+S(%p5U@PXy2&jvp_ zR?pe*XlUI$ZiKdmA{2~U26CIr8B+oF+7WXfazclCzdry z8TjGmvQ37Id~p;?sSiGyGFE3qg2jp2|7ac+?$Qj(4CKDLCzrIRy;@n5X^*08+!&)HF9A>?*36ljju7gsJ4*o4+EVe0N|PDK~;HK z#rnv4Lub^4_p#7~AdUEg<7Chinsw-7JvGm@w$KffKkvnmEw!HiEA6fP?9wr$vmBS0 zAcQ~zHj*uXnifP3n|Q9YPW=`!t)PnfC<1lEXbWDMme4DBg zU8_c$f0$@%e&EvO@XM;xz&km3tx-kyM=$4=&74`|)CWoyZH``A6Ou4{9p%+E_OLM{ zie-={_J}KU(}}P3&de)QP8$0#`Lnfe@xwztQy6fHq4OZGC42?GzFvSAejb`xjo#vi zI3A}f5aqYnAfAvy$~y^@En$tBi+&B$4=ULUC7jhC38rNVNVgrXNrH$xAEs3higNdb z&LmNAq*cknG15h9@Z2IOIkj4O`!bfx5ZwbeB`S8G&89`X;a%1wKU^!$$~w_&KvObX zrokFg_IhMEiIlU&9BIf0$C#|E`-aX$FJ~Jw9m$0JV%Ei6{rifm;m~WwlIe3BlV{{b z4N(Y?OQXxhuwY0>wNbZ3(ul_N(E8Q&2=%C`(z~83*3~Gp>Zom5<%0kcNgjcL3zL1QxvxL*V9SlCUsH#H)kiwk1-Y>ZcvKg=30ldt{&{F zlyrx^O5-UVDm?t~(6y*D<<;}@p1x5gl1n@3MWS=ds^>0!yDHbIRdUNJk9*hiQ4NvG z$Mq=}TOPj*mYKT{I}O`Bqt1D+BrCp5gXo1)g{my`NEYvZ z9aV-}x``H5L^U=r>;-&YW6F)j>!jCfKUW>}LD25!DD7RxTrU#5yQmz)JSsQH%`iKg zS^72x1>AH#S&N|s(x6o2=9ez7mHXAjHfthNhbse{yiN zlC0_I4Go>R?KXUwoE=GyRdfWaZp@@R&sKg~-jjkLW5-QyN5+2}wmT6o4?3@nPnlnRT-@k}mJkC4Mbwp0Wuh z(qwYDy~Nb~bq!lV(~p;jb*cyKN*WtIx_3j?ceG26{YV**N82UyEiIkI_wI8Y9aqj_ z2`KP(E#h>RD##eU)J64wxoS?Co|VC?__8iFBTEwXFPaGolL4{d1g zYk8)@B5(UIXt8afm>$}5AU-*kEixdksW{oPaZf3Y7eFiMlh11%v+Wa)Hz!5P07V?j zYrs!9Mm&mKUS3`;?p{C_UFW6KNvE2f2Ey9~i;JtzE>DvLfV&Pv6wbOyH_U?M%>djk zgT+?!jNsr>Fl|?I?zQ>kf)2>2bI^T;tp2x?;_Q5;gIAG(K(WJL?&d9#*sR zM9)ahGbpf>V-J7n6KNTFJ^z{raZv(rAz=CQuOF2^FVHJN4>;@qJqTQY;l?F^w+47b zTn4&1=wVMufOm8Ge^OQar(6l!v2h|qPas2si8L@=yd0|0809Sp8-iVjF zLM2KOGqXy^`tQyCgL!{tFc|#fYw=4$K@88|+oB;aQ6^|96BNbGQJ8`P94)1HBt_QV z{?Hi7e*a%1tl0h7KT6N|ii-8Asvq%U7U~)rlQtj1!k&b&5%Q7ztYkE`xq$A+I@KG8 zfSB0oYQjNQU3+639-r+CS{eyR_CPo%uu^?YoR0e^xg~D)`(*H+HHWimx+Cr6ScfoH6uTRuV%#5K zB4C>sTb1AQ*%{q|OLPAM8J^o@UtFu^bqFAXLEuns$Zs^CaBu#|t14?u!_aUxDad&K#o{CqQ~@{-oCqgVt8 z^_6+T?PCho1QB0pn$i2S#gy84HPQ6POpE(K`78a3f9iG%Oz!mZ2jX0E8dHbkY(q;N z&piCE_mlS9s?|YnYtHV=3T>MUav)JxwO@y2PC@)StsI{8IT^gntJ#8#i`D2;OSabw zb(R80AU%w;Dnb~TmZ*Jce8rn^a*SEyqLjx8GNQ*si5BO}Wb0+h7H z5=O({MBIjD2=Ke^uPD;I?CreG3^27ei>jD!eCcA9S*boYI{Klo7 zuJt<9oy$xYL?!I&X5HHaRnI<`J;O)Fs*?pD$R(kaK^M8Y%ENxl_n+gWsQTmM{2)X~ z0fcMs8MeK5jhwvcnSm>x@yYd&(Cz{CF0snrTD%rK-;&A)Z1If++X z%ZBC48L_S}iJS;I-%9P|)H<~t6X%oOMvUpfU;_@x9hEs4^wCr=|EyyN2>tU!UKgf) zTusaW_w_Tplz>T-07Xz2w>C;RaW=Orj2i(*)B2;}XlrG#2tQDN!s?--@t!BfT+oOl z93?O=tIDd zoKeNxSk854?*ZKRczT*;aLXXDUcBa6@S2&nA`1s!j$N+m-*_o+%Se`o6Y$swdY9it zoo8QbC1-8u`}0jpd7mj?;R_n7p58=p)14(RrV5pw-{p`#wUFB2#7E!fNiP;$2rzVo zkfAQ`QUR~e--Row;^*|3(>cD^wLi`1Joep=DRlqjshSfL5`vYT>{Qr|OC!WGwsT6E zyD8rGOva~29+Ty^e4qXJ@>89(l4^H| zUzisOUuP30j&?V_=v)o1&%AZq-D*1$14#OS$aW&{AG1TUJ$pB610@@4+Xp5Bj8von z+zN0nA5o~Rtcm`|xZ8q)4sNz2e{%y)8i2ds^w-mJZ@6{-w8rf3MAP^}AP}a^AJFKO zl$&g9y~Xr@V-MYAll$R4<3@^`%@_39xq*RKYheH87LNr=c#eaC63em_2uMI|DNzgj t8Umm<>>)r_QboFTZH56zNcPbFr%*aEHYj%mBK8t+sVKo8m%vPY{|7s%;5PsO literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-supplemental-not-base.png b/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-supplemental-not-base.png new file mode 100644 index 0000000000000000000000000000000000000000..0f28e5f409408bc9764515fa382df95cb708a074 GIT binary patch literal 41454 zcmc$`Ra9I})GbOv2o@l?ySqCy!QI{6-5o-(;O_43?(Xi;xVtv4mwe~^<363IGse9S zJ!;qP(Y06ET651et3%{uMB!ktV8Fn@;Kap*6u`i~nt_3Rae(^zd1sQM#^e);$175+g&@6*^V4GvXH!#7Elb@LF}zPCh?u^syZEyH0fOF}lGK_6qUxm~P_ zYiPQm!r&3Q&zrwge@HdWIGHuQPUx1xj)C$y_+1dJtgMR`yT)1UCf&ck&|_2;IButt zYBGp27P0tTlN=Le5D)lxEoS9(yR2`31qi^~E*IokXoe%nNUl@tZ7Oo$MIwc(PO8-z zUUy$cApb1=k;UM?W&$T|fhEt+tsN3*k%~+vEoLsld?3{a7&`DVN)AZPI>Ni2RMxH$ zFu!jnZ*ckoRUsFxUxD^f6N?6AFQi&EgQ#hRvbN`=@|=c0_#G-bc*H~*H=_mQWM6*F z=iBDlc7GX1QsXUSSsO6;tjr8~ZZ{O0HbugNx)yKNY5}}yFo`@@T#y@~wYg|jsK3e< z?xR>=ZySWeIZ_P!hOh{)Q`o5^=v6$f&-Ig9tGk~xs64`a6ob#?h6`?FMB}i=l1kg- z^7y8h>b0n(&ko@z(v`>SdAABv@=nOBvGnC0ErbFA9$Y)7u%8>>~ySZTFh%56P0U@a6o+&&0$(TxI- zW#VaxosV0AEHiK~@JChn42qa96t?%jD4u-rqd2Ves`K&pHT)LED7K2p%JLoLD|aj; zt=J!Nr|(KzsJJu5IlQieZY^OFaSOBYJXKl@P|IAk8z2vZ&_ZalI~CC8PRCFN_aR(GbmE^BbiMz=4qs?f3Zia`Pp-e7rQ;pNan^jV49%sSBX1QkfkLla?oMxjnv7$)$a1&o^y|$fJPWdp# zz|z7)aBjz(2^0o%{C1ub<(Jc%*;6dr@#r~ouJ+i> zU=1?Je7AMpqI}@Q!Ra{HG4`hhc~QXmPc5`a`RDA81%=opZWz+e_kfWl`0(^65gxFjg}s!DA#6(XN6*A;u?g4gpk?HsLLp?^>(~YlV8J|8Nt8X z>~j=-hfsrP*t}&rlC~_?MrZspvKP)oXNWn~WRnr}qs9dei^)BBL&jp72WPu>XWkf? zrb3gMrY7i+O#w5Nh<7BL0Kki~z?0UfR?(3mDLX&es2$<6uw5%}5V2qQ!sIQ~-pvml zR5=&lzLgxN@s=bOW4?wt<43(%rAyQTw@M`WmklSC6XrC%=cK0=yK$5rEC1%gHPWi{~P4aNm9!t27{v4>EQlc0v)qG z!|Sg)KjK33D&?h?z0lHL^6;z{e#?m2?KTcGVa;Q=L|1K}gZ8-lnIbd>RXo z!m%i8oHI%l>|A}st-e`4I> zGu-~}ikq~B_weiEhbzCk8~`Rt0Wl;DabF#E-DLJI^SR#NiPj~{!9PRbqvmm}-9O9$ z)(!T5i1Xm3C%V$Y!Vs(fLMGS|baAgQtGoN2^N)YkX+^n#4~rYn_KN6dEt~wy_P5XS zx6S{tv7a*kes=VoApKuC4fl)VA3Vs${{5d7zu3Y4KWqT%I(O<~wdrGvvkL?76ojPE zQ8F>|D0wcWR04!i$-dDBT&57$;iFsJ8wcL?qWJTA}C9)6!kr_`BnXli5= z8YFv5KQu-cUF@!HQPW4ZpI;AUUY%)#jQ;MH4=?uz4jaZNG};{Y)#li>sVbt7(9*9c z{If%jLTZjS^_?eb?UzNGCgtg)BZ^zkBHn(R7RsWU4m_7RBW#;ABAI!pUJU$sg zKnuzmSa@+OhR^Bkiuq`^WBU-3KSWlC6zC<7!7P8`x$!SPx6xMWD?+)0vvdhwm-LO_ zXor-d6fzRPdGC|M&wI@_E2v#^6E9C9!x^5gn=$M#*t{p> z$D3J=#ioo5*v@FKGz+Smr(DCHP3ZZO zBDk^n6x&}rANd}xX}eIapYwm@7EVU|lh-1-MWTPRZO32q(TS3CXS@c6T+da5B_X4* zh6?4W-y$0S>;>YslyW!~?(-{B62p~S`l$d?3@a9ZhpOqhI>_D*uWnE(j2^HO~@^#ugT&1{VW}? zQ&$nzZBDCzINCf2RrI-h4&y}PjYHn5gy!|LymW)rd{`IRm`xNi9sP5^PcMe?kf%ev zJuAdI8%)XR2d?if0w&;dkN#;FNXRsspXtea^H5>K|OVg2?slTS+c=h zNEeS#FzEnx_qOO2k+ZQpD^NAQ7WYYhr&Kez>wCg)YIPr+zDf^i0q)_yjBWm^kfpHT zh%DiIQJoT_KbZ?$)_LS~2DNx><#%$>jva#cKDxDH22R|2rsLTp--hKwQ#G0dAWxMd z1QI)@==h^#X%hL=8;%}IMj7-eI1dYHlMjL*bbd}I#Zkb2LW`TDU$=Iky)P0=f9~mh za+r6M_5R@p?4OgSTFRKuBe~#-mZHAwMmepeu{iwl;>w6qLdro3!Nk+TE$>qh=9QLI zP=&?#X)8a>0`PFr#j@l>-%2iDWYJL*G?|O|SatmGZ1c1^38$0}Sk_ z0w+#Uj)+iE65w^o?LFjCGO6F6CpfI4ii(kVqHlTbIETYQzIWyRh4TSh>j zS0(33pwFb6`4iUXHssywqD_YjRL9NivYSu2>Ukx`MDH&NEK;MFqDI6T;E(rV2<7g4 zY$2ErmE%NXYipEpTXEwGE~t-7^QS9+b}pr>2uqIkp4Wp|wAoFuBdWJ&xjR<>*6jh^l;+mQc3&jnbm_s5eAo5Aj5QaGBf3{Y!V(%jaTjpyAF&adK{~ zGr4{a7Ip0t0=^Lr>)LX$nt&sJiA#_OjXRbNDNlTKdzKjl8S9`-CdKM)YgzVfq&b&HLJQWUCg!nImlyf;&8!SKwwW!$gTSGiRs(n^ zQcnNws}WEpjM4LcQ;?|~Zsfxl-O{gyDl3`Ur+#6Z?9Rz=fi6U0g|H>H$JVAsr0RR` zQ?+4a=i^Pxoxeog&DKiOUIsbIA&=xTkE=W!*8#(wr`w~A&Ph(fbWPGy)6P{1_Gg=< z7doa>+%`Ug>(x6bOSiP*5Tjx)K00wxZb{10=#All)}<0DNv*7g`j05uPg(@374q4K zns$_cZ6Tof-%2FqrEsFA`RoG+-HC+UP#Dc>80Wo^KD9POuD+c6N%Yc=f&H1c9~2t>;`O*|jv~Z?neS4I^WT*52+< zpppk~d3kxbh>Wi$AuSYkC6k=(=hK5CVYpajLaOKOm%`kPk3V)z7tg}8v4asdp$u?o zrby*+g+uUK%iA;rgd9!PgA2}+xId|cEndh<`>$0)S_co%t6W{QN6PKdLiQ8|9?WUZ zpOD}+?h{MsNU{mb1E$uEZ#8tJYHvI(_5;-xKOOXy?DqgsaewP^5Wtx&=dIgAK7Li5m?R#<0-O$r@fgxQF=3Sl?mrLfTk-op5^D| zqvk0ft?|NkUgp2vW}CWq*s-y)K0Q7%#A1qrW<>EBWzf-+YHOL;@T8r+!w&KhSZqm^ zlCIs17oeM1_>%Ki6m%!3QQ26Vc5bjN$~bPN>RW0$J4-Md*i_?_7TH+{=QY#^hdAxr z3gDLUa|(krY@p*#)BYC+bW2l(D1&48$&{!Oqtj}{$Hv}}!m%aNY6kJL+pPU1u9i2i zwyVszxo#BI;&SZwu0P+Uw5*AFdIYN0FGlLLG~wi+q)Fq$C)Yhf?ilXl0vsQQmKofB zYAY&hCmwU&BJX^x3>ynC9MLw^we_ZG1Kr45cO2YOOg&If|8ZVmxR1=+1B~8qgzfD@hR8Ie$qI`(Qvf{Wv!mK~A5^RW`c#b$~wM$fD zy9dPZoA>)WlZ==$u@ydUDy~8&oLA70SA7-B!fHyqY~8I(F=`Bry^wn& z{VR_w;LQUL-LbM}4oJ=ie$JK2n~0M&wf-Tof>n+fY_Y zSTyNWhLosdZU+b1Zjz`LlPbR7N%<^7z;I_LZb%HlPW%!qQl#E(-q=#($< z_TO3(N*H^hbDtS9Z3WUX7gR$rSP^v<<|}>x>xgFx@nts0fuGiPZ;CzyFtf2WwzQ-; zJCUUuqbe7+8B2G}jy>YQchRhmDY-P6OFKK$vK!Xb9@Up9P634%+2@Nqkv~dHOH-Am zNHvBmsHn?I6&A}^)U_406~{Oof0-YYuTTr4{E35k)PhgD!=6Fi&UYcjhD@rBoXoD@ zIYXvW9|GxZw@+z(-(QyNio@Jyn<11sl#1aLf7Mhd^pR}yoGR^}1ST`y;@p*m)Jrw` z2Ri;mGQ7wXKfe~FSbxIiS~tQJ+`;aHDSBlHZMi!MplNxPlILq)O@FrA{<0Iuo8;Rt zrry2$uZwM4cfBbwG5q-1(A(SFaBy(t{<(J3u)QHYz!2rQni>}sm~`uH^H=#`G} z+9jl}PBZ*EP z0N;IT@IHP6DfAiM^Ho5eJkFvfXDtb-E&4Z86=N^uO7KlN|22Alv2A}TB9aMbkg{E8 zVKGmvB&D$TAR5AF$J()Vh|`l}W07d0-5f%EYbM0Z+u|Z_J3pPSQUu(vK1-EjCts|~ z9(0!T=c^dOD94}9tYWqwvOfh8sct*!oR)3Fr$Vkf;mtZ^x?Zrc<9q0-(*|nDfbOL?Bec?Ia!wz9K5%3T2$w70h|86Fg}K zqCT*`l&tG_{M!SreW!uQ{sXZ&iia;!ssSK!e<$rE)s1)m9>v*c9;PQx%#<(l6Euq| zN1`i1LWaUlk>qoHl7Tr~bhkVWB`b4dH`Jjw@Sr?^u8@}w*ZQUiNL7mFADj}8CF({DzjljGz>1JEg&9c1hrX<>JkEeyp za*>7+Rr^az8M=1NoAg*=wA!ad-EH3j;`YnHOWaJ%_vpp;<_{Cu0h8q^=82Le{mFr` zmXVjd11NXmu>U#Y%b%Zb7#KVUzJB|T-aHL-k-$`rbsBcT>F%J8O(ournu~Pu)6Z7H zHb_5F{p|Fb#_IAc5GLv$?g7jAzu->1G-JKXWiT?CI9y6VOWk~;6=8;8mha~%03529 zUdeY1i%MNrlL@vPVje}wwp%?*n`%cldsuQ{S=crAjhtzwI?j$L0A}*7E^1*qo;HI^ zYW0fl^aQ7|$-WVt_?UjVol@KO9mKMn-qq8tQUjphdCrpqdVQbUm{q$}x?x=gCbhjS zu+ro3DJ8Oc{#AAIA?NN}y<#)mb`~&93=lFyJUv6>0u8#VSgC3*>F0agUteV6i*8kY z2>?|){;+6IeE0>#ZllUYEZe z_OJ0+Wkm9@MVuPEMlM&R>Bat@wTje?&AS=*W7u8dS}P)0d< zk_OPt|3Wwfr#P-4*R9Vend^v31S%{u7c(o@=$v^TkYWi|AVweMk+KNys_Y}F5*_x; zqNwz*UxqJSa_ErV-B<*=&DOH=LR; zlkb;~B0jWdI7lX-piJ@HEI#gn4%4E78*F-Ay&sOO&e*L|Q;wknm6`8shZtI%v&BqG z&PI(j?Vv|nJx#;q22VJAFpg!1DnON{1WmMawtMWBx6fvKMD8y?vl2jdm>m~3x#Yq~#ib+)! zHJ6?R*M(O&DXG|mK}xHtB(>svf-2v0#zxF!Uh7wh42ob-sgpF%69@IklLPQ%Y}v-t zZYHD4VQ#x&bmtt^Ehp&w#pM_54IfF*UiM+H=u|yElw%UAS86RIfG}N^&t3o6Hg=Qkv_J^5x3o+Ef z?)uiguT+(Um1-zYSy47`(^yFHVDM9ts%Wvr-mk#IU*N_jRj1X#;Fp{P>9+imM@7En z`qrPTw#t-ou)EVpK#%VI6#PbbGH6vrrH}79G;F&0o#fp+LjGV+lSUo+@B}}3X)N-+ z+GI$z-ZThM&(nN>0FAsD;rPC3)owqH5r*7aj^9Uu&u)1sm?2KLe{{r_B5dip4Sl8c zMD64yWwW`N$eh@4Fg$mwT9x$1mi;}4@4FOnq{IXNXp^^#jA1PnPw88n(IX9pYG?{i8q(2!d>>eCugz^Fx!U|e!CcHymzV1vIWEpaDe5xI@;S(9g^JD0;I%drBLN4DP8p1#C?faqsVEq~P<4E+aXc6qXWDnw$r#|296mU|jS@ws{2S^rODV#q?Hx z%m^1dU$JMr8b)TcJX}|rpWl`9-wFB}I@S#fwUK$RtN7*ibl5%QCVfc%e!%%T*+jTI zXM0#nmg8n;>p<`eHL4`)#b&+TzM)wyl)!P=lsNVz`s7jHy;$D}|7K>wThd33psGzq zkpKKIDiwkzU1#jGK9RVXqo8HYnmBp9U0&55#3C#z6DPNsY-ehSOz8VKi7I<@FcBOp z4Sp8q$Fxh^J$M=I3x1Qd0z}k1yEnDriOdUad}p_#)j)Q2ZoPb+nQ!E-owFtKijR~E z)k`Iktibk`j>4l+dxuaR%U+}T4Fpe4>4W|%DPd+RGMhspUC5*(UjCmz$9D)Oc7c0f z+%;iPe-x3b|9Jd?(4O#wyoU=Tswl%?(bl6KB{Lfbp;h%T~dfJyYEkkm3h7_WE%V&BZz^x-pJPge_XJKf zYP%*sYqv{QuW#g-+Ck9GGCOMdUER8!fY2?M->Y)0Z?CQ^-K{ydDhHY9gK#xhT@Q@k z`s8-aG-kLL^?fzrv8TAw#6Px0*o}5?bIyBL*wz%UvwxhwtyONY#aH1`&U%`A^WkjV zqLdn`sh`%griiQ#O*qY^}TxFbMrIJVNJ7Z?|m-^p%i>+bTj z-_A`u99GKn#rs3Rwq4EJsD+%kb=Koimx8ghIp8 zW2BqM^O(;is;d*iry|~xDoWr{Z|yfUyZ)@%Qx8TCdS!rT0isYo(q57(nm*9V4m7?z z`8A(cBgEYd$$eT@Kx)nhwjVpHFi%$;wKC0!!%B5k(C%g@K73ynoKEob@cM9Ted>h7 zG#zm>jl9>E8T||gbRb@G$5l-E3a-qqz*l^9t|;wTc?u?|-peIdcp-EJ~lsakBLv^Y{OQX4u` zPeD3S6L22R9l)s=%x3ZY`paWAGD2(l5R!?@TDth4X+V0CD8oN^i}9Y42o=8jJ9(m4 zU_(#ERBv2O&{(D|pi)A76My+#pSh@QY-xjLe}%Mn?U-2ky0GTEX)tm0Yzoymj%12y zY+~abYNqP-u}#&>v8RJJ+v#V@s#SOj?xBv6>NyB2f_;U3es6-wRrVurMc*fhfs&To z5i=u4SBRKpy9iwqxITG^9(?x^IIQE@7j}a*;se~e2gPU9BLuC_oj@3u?)n&6%&K0q zbx7(#t}_2{u^h5)+%@zs=}t}>B+5V6%`0i?@i~8N#K}C5Cj2g$u#$m^uCWw_7kK#K zG9&E-9}#gUduw9TDjV-ec1JiPl-juc&h(x2$MbQEc1K0CYE--|wap7TbMnX0RE-_{ zbBOe+eLfb}Nw4hR`h~dHxjW0T2@cI~99%cW*&$=+g)C_;^+2rJZmK3rp%TwJyFuO$~L$mAKy5%0Og8 zk6()X>h2N63S_0gnr)WdmFOK3q6QHyb^KNKD2owl>y;XFQ)qy5m!sXWghM}Plc3GS z$wDIkfDhWUrIFD+mgn@bnHwRjaJ~#KpuTTD?T-Hst;XJs!cjs8U5XKzYmki1fjC{n zS>n$ebP7pf5|=n@>}GgsQdRmzGW6)lvuIsn%AI(DcUDe6G@>%&iOI}OpP0Q(Mrtgr zMNBUYEBb4BvW>*DDRsRA`QNqL$1ca)67z%Waq>&8t~Qr;3*721-{~;-;yVpr!zPcH zu~;u!SjRg(Z88~yF zEA!n4r(LNWxW&i`4b_5t2YjkZ7WYZ2uO+#R)jfL zDy5Lu?g=|ov$W>p=e;Z(D3|7v>>2!U*HY5AG<~s`cqhxuKW0>hoSg3V@)P;Wx_i-{BSyNd9sg=ddh@H)jQqn z4Cd>C{c=f34@<5heX(~5(8()gvltdCI^rqMc%5~~ksCgAz)lN$7xh*QK6&w3Df($? z3XT3^C?P5N!~-urzR&!f%~FGkzAQ{yo3x04%enMm;2CHEh$2Tx)F0S~9Tf|5k^=T` zd@WB6Sxh^$?F>$}6vJthBbqKK_?j+s)gI~^*!7F!qYmRt-O||6x9m(Iie~Z9c(#&i zOk2hnmqq0UJVK{4;y~7&GtPBLS6#()&*x*nV9^V*o&ONr_lxg?4y03BQefQNvexTZ zQO7VB>QuzD$CnKc^^BD^RX&O$7+F=HkMg9Sthzkb<0Ym1y=QMP_qbeMx0MwMs!nW) zQ@!78SBLD?5FvW8vg#D_RI>UMe-}Q(tiH&o$7CYP_PN^dO$bvA_gG!(@K!y>0!v5R z$etk)@ObpL17Mlvu-x{W=KOzq ziZa9X40*-HPN<<-HAVT4KTD@>|I?>>n6Xvcf(!SJY>;2q?=H_O@K))=-lvyC@8J$J z+L(EA=D3UUtXzji0{WwE4Mc8+5?>TZ_wyTW@$zb1%M%*F} zQl^{Pxf>=MduhY5n@x%roB(SnW9_=b?Sc7p>0|SjoJ7q7>*n#p!YMo+jv6G07x#lb zbnSH(*EnmFe$o=e*r4NM_o#^dA^>&$ooZ<75l(7)V&Arteqb~B|KuuC>>BMLyLYjwsy?sve58_X<2!E%&9GO80_>= zOR+f2k@ec(@>s+j9}#)Av*oa8()N=RqnXVYb39(( zi{B@5_Wr*O!$|0YmX?%?+|#ov!c!Vgi9P~auwpa3J= zE!l(U_6i)Wjn3}w?%v|D2_$%aR#NX9#3GD?QS3#WS90*Tchh5NYA>ZA=Vh+?tEeze zUo|Qj2Hh(}k_b%=Q-}2RD>$=*!(81BgfXgmNY48^VtZ+;Y2b}StfE2-&VkAL#h3r| zMz=H>P~<_Yg{ePq=#qwZ8C5Y-vKygDm+^@ys@$9;UNrOw(Kvx!xNKjqY295SV*3a& zZ;qre(gX>5>cj3Y)sC=B$Ubv{pS;sX8TxBsOl;+2eoK74`xuiw*k z{}&pgte9c*=sLRB139b)cK7)fnz?8uwts9L7%;nZG!*!u*6@Trec#L3{-piA(XWs%5eFn0;LB}ynNE*WEItMQrgD?98KrFchTl?%H2)OkJH3YO^7 z7{8OqCM>{wg!N*otBFzynL-WsQ)O%tSSvHk(L6}~qD1DJAt_pdzR{kYEWQ+!2R7}N z1{lxWt469pR&T8Hx6<#A>z`*5o@24PQ(JcZsy_~%W3OY27zZ2e_E%ILYAfc5Pu&ow zQsBkgXjED1>HnOc-@ht4lty30v*_MzVGj4gI3+7%%*4|@EEK;Mq=})Kvy+XtNC678 zSC<7wgwdh6Gona$TCgl_}`VsijL)jhr_*NVprbJQhc9r(g0s=ZkMgN*f zM7^Vuv)qjJBLV~G`kZi6p1rTu&-D~AQxNBEI*{F%xLw}X>$|Br_J&5v4?2E2PE^av zBp+`l^U1FM$xwsEjGr1zU#EW}}JGNV$*ch~cyy;kH{ zq_!@eCgTZ zG8)<{^OA}!u?B-a+JzTNMehI}!or1$Zqh{?6h@whpo8#%vCckyGN z*+2u1t!=ca^o#>qrsNioD;)3|@*my?b3Cb|LLYrH{X?7EYwxVDVo zN+SM*5xTY{(R#vR#LGK5Q_uS0=3fQ+E`sz_-uO!CA;o&0g8d#UN96xgDU0uXE*aubz5&g8>Sfk448mBmx z1{0KG_9ZMdXZNor@uW+riuGv&m?lcLu_(lxa3u8K)^iZ#P_2U@2 z!Q|`T+`bsl0j6c8iJtST(}oO?82WVIc&d8zht;ut#lO~-ByqMdFKULTjtKf8; zrYrUYVs61O07Oia{^tdSH4xf(nIpB;$nktA#Z!&_zfo9%`4lbmU+dnfD9B?m8>-8B zeOZ+0%r0+lPaoT6Wf6IO9MGac(tWcfn~{M>e@RM$VURKy>@Gbvb=Q*8FnLdYpGz7O z`&(%jLXUbA@;%AU&5I6QR#QCF*ounlV-_!Fu@dUgVXPhTa5xa4uMOM43@yu2QV|lb z@`^_8aL(9N9uw=Su|6#^2~8fH@Pu4Wl?XBwbXj&oLTX zRpP9Q^Oj!WlU?lZb2stsp`ir*DxVMu8Kh$MKY-dBj!*rk`7H+9X>;^{b7Hl-g* z$P|~C*{j6K=Z$IomFO4q2DCrLSI&)>r0-7`k$2+oDCV_KFh{cR5RmV{Y3G44T&uR@ zdI@OZ*mw@eb$MaQHd3_6Wy4Jp-fjy=~}r@nB1cyLNO?{#1f!u==|vze5AyM6PRkvcOWnc<~2V5 z@-buEf+6uqlR=H*)GGxq|19(Gpbd7;Fx;($>n*k>c{!4FU5t!lhn` zoNAV{-roh}cCpN5gX;TazM}H3uR9g@q136t=p1;N9Tx)G186ZFDy*mlQb6`X>fR7W z7>WWV11U@hOMlIU*I<3J2Hp_oE<|L?(9T~Y3O90XN%O{w*Hc5vw$JhFc>n2hyLwIo z>uN|Zq7Wd}HaZKc_0s(mPu>GNtdBh9*`!W(HB;Eb%`8+tbjsuwc5Ou|^A>|fTMO$w z(-JQ|k-T+${H+~~DU(KuwK=H2rMDhDue?3060!L767l$BEo;W_4TG>)4C`WU!S;z& z7TF)XL8~`|OWIuCwAv^#;|qTsZfHg?;uF|ml`hc{c;mz?!mynIZJ1N>n}4jSi=4cm z>S^Ys?vj~L9}nxS_wz~A3L!p^l8K-P)NvMWvMUl134-U2Skpa&d}^dfC=-Go;H}58 zpSfw%yTWn{v+*Ivw$06zm6a8VUAKD^X2+5ov9N%bWG58qUiuMPF@HuqNbg`{pau}~ zP3tQ-UE)Y5b=B5=H#;7StEV4tY4DnMJH%`SmI9F#m*y>yv|4XHHk|6x8{h|G#tlgS z0X(N{YRQJ}O>aOMDyu%`?$sE~YgJS_wdZbc<4l+fas2CBk>gK^j|;_{v)B6pL#HX7 zn3z=szv%tJ5N2m9tkThCE3@r(iW%D`Ljc;O0en{jkzX!g++4V#!oEum+-9w%!{Z)m zOwNzs_Fy^iW~nk6m%WLS-q;r1!?2a~KbicMh7NW5fR>HEl+)KH>zg6^Dv2<7J4X-= zO$E}Got%NWIdn+(u4)3BM{ApVpwJR4%Oz^Yv5H(6X>A4)JUcfh8*f#BqJq{qqLL|x zbOPY>U36~x)~TCav5#2bD!j2YeQNLW;s7m4XP8ia6XyTbmKgw*XvWBY4B@z-AD=I5UGI6_sBl$ZC%FS7eoqK7zgNMq>$a?&e&q+#`-Jr+fnR@fRE*-}ta7zBQ z4`Gis1oxVY!ks#>;R9z0SMv7lL_oIu;xoCtri|smhWB(#zj~q2@6qw6a_Mlw-T32{ zfRx_JS+mWJ9)Z7T3y&Ld6v!*IF{Mk_bF(t=d7@)lm_kMWy`bH4TZ{V|#67+wD<>Hv z_Y*e*`(y87R}CPLpgK+`e8@^Te_~|654|R6ZGaq0HV{3j zv%<8XsfxV}6c#S}wye$(5Z#1vo^k7+-zn@Sp{_}a*iWv3DIxmzGjcLr+c9<*~8`h;BEU z*72+r=h+G55<-h}h27@T?QmfxU||SuM|y0L;#w@?b%z|aCpCo8L}Uk&`;lx9ybORw z4GkRPUN5yf(Z#&DZj%Yl%`F_p_f>BZq>-747$MFe=NYEh^BIY#UY_i|w&RcXsh*1B zVK3BTD<`AwS{8TPDi{xBsNJL95Tqf6SPZ@v%4A)Sl+k&8d#IE!gvFX46~YzP2{``7`lmOYiGBl}A`0FpHV~I7yizL++(q*i z>&=qKN2#~d6|M$P`h$5Ynp-%w!x3GJ_h>zkr-KNJY&$6Z5qPo(EL6Kett6<}B{FR& zfjo^e?6RVC8hKOw*@NAnIb|7BljjZIPVe+rR-8IRGIXJp=VED$NfLIC*R#6qQe@Fx ziON(!=XX}Pk52Y`%mrUH*wWY3+;l?_KAw8rwGJ8kIpv(8K~bM~lPrFj`8ae7ht}(l z$o7&7-)Bi?e2k&J7x!pH^<~drgr{>ggkyHD-gi43k%fFpeY55XsnOY&QMqonLF3aD zl;a?HUk`PU{77RVW{LOR-~`-Yf_%K3A8DP`PHyeDJ}9UoMxoQh>n*!1lhe*>p>ob( ziX(hMtl8x;%=Vcrbe;07e(1VbJ4orwtEl%+v^j%w%j<%0rcC)sC<4k|zG2t{X96qi zRhnZ`Sh87Zd+@kqqK%(%0QoZ^nN4~d$7iITCdW~KiB)S2_qO+f>BsM9L0rtOh4Pte zTW+QG2E5`)?k0B{eYZ0hm`bB}fAL5^<#ni-(vK0hAn!oVTBvKFk+q(Xz-{3aG)l2G zAXYkjc;mQt)C)fNI8YZ4&tU#evVaPoo-Ko;HKcFhT15%3SNqo4L~>2C#R&;;T4X|X zT;W(D!F0DxvkAXL4y;SSd8#qAn2Z*80{jv6SNfOlW|t(OgFGKmdlmC~mRRZi;(v8H zUozEc98r`YHSSpUel;S7#}oDrZ&q;l3px(01A?O>cv2}$%BcPfdx&lSlX(rsE}FfA zKI4s$eqVj{@9$=TXnM#urdxzMtm1nChG>=VRclA&zDQ|BMModk*aIKz_UU7&65w8i ze^?4$)>wVqB5{lUNX@Pr|LcX@=iy{FJgNhTh}iuO;QLGxw&E+(&{NZrcC<8*ZiDc- zs%EzUv(0M=#ky9!JQg)SZBj%Yunz+X8Kn7_j67Cnb35Gs<&?#BgSlQ$lp-=yrxRWu zgOQX#oEhYRE>7C#(=oxd4OGFyb5?EM@O9q8J4u0vyyxg#$cG-pomJNyhpCKM5opq; z#dAA!2EgZZ!hTL??v!YjlUt7U$d=BdUPQ>_LDT+P>}x#_JeA9<*Eri*gXw#-me=iT z2F~SVgxVKu!UU_uKFNaFX0Rf0fU<39<4cz1 zpen*KH4_Xny*_S2Cf8Y9%WbmH+plX{+=VI>0!{m^AlGUzeGez!JQFIA0bkUDn@-!L zOD`<*sVCoLBW+I)X*j`X1;}>{){gjUI>cfGG-i&Enhz)zWjhiFMYjJ8R}NvnMOdQ? zIPo^6)>=yA{(D^0IBMADW_P&&W&D6Uaz9l!xySqH#KKHO%pHoh8lAGsB>y%Hn2It~ zky)=}olsQ?!F?-as)B_fj<@Am%#eA&eh4INj`gb)zpKsT7CLm_ZWnq0`L)E=w)lNu zkEz7|wS^sVj6bQ+l*ssD@2NT-U)N5>oxILFct0T&LHx-9XvZve!s@I19j1`{TL=I7 z4+GFphng{$?pC)7sKJo%uCiyXNZ5}<>|q!mZ$xpj%gyQ-SkUq#*@Si8ulTRO(s{yDQ7mGuK^sB*dtV8#0TRT3IqI;&$%u0KJz{&es+?H^OxR*ZDuxpZw z;HhEP&2p6Qm?AmAYQs1omx2T~T+}QPD)$`{e0)=KI3|}n7VR#pc`oeBiQOm&R$hEx zQzH=w0k6hX6mSM(sMdwW&z$#pB{)_P7yP2A?>wvV?tjfKp=GYXU=R>i~P*Xv<$}vg7 z@&AXmw+f0g?A8Sn5=ejqf(H-UIKdr)ySp{P-Q5%132u$M)3_5{8n?#X-Ca)S-+Q0A zn3}1YIyE6br?kG@o{=O1D2VpKP7_nsf}c-SUDKJQ`H_j z0@(zA3kFiaQ8J@+HDMtwI$DlGD3sH9n+;}K;q>{=Wl@o(82cP+6K|v(!X}xkkuQ#J z8M)Vj5AJ1ZcQ=xzbDPiRrN(Lr3@h2p7t{BW2de6aSc4JZ`?h1LQRTGf11#VJWl)@Y zh3*=Gb^44(e(q|S^;?ABKBI<0Z0N>l$@PT$>u8IFxw<qyg^h z8j^4Mv;49WbnA|4QOWZw3k%G0Ks65qyN^>TRuuPJJGqVHrta;mJ%PgQ=`&zj?jxeH zNPcB&6C7@emhbWAUf%9PJC-({2yfQlVOm_j`?oO13FoGfU`EOQ}G(lf$|zTQs@14Wzjj^Nzm0Jo@I=m6?a; z&B>0&nyO0kjt!q(la40)k~f+)F4XljCTb7VI#XK$Pt3QdVdUOl9m)T}scPvR@CxNJ z7iuqm3Yn11$}vPocP<_ra3X@!KW+~VosceQc9Fd0{lxQm`@-$2@>|#SsJ{QEr*o|f z0jJN^_}kYW1EQqxO=hWx%_+@`DzS~vWPj%3ZhB+2&26(>dO12;<3+mopOmtbdfz@u z$Tj`y#(XG2+~>g>O}*l^7k}V#d3$R~w!^pWJSAUv#~(5GRZt+{96f)q=^%rUxWO#F zhNJaZGs;!u@U*1emU@#>H7&c8E4W!)TA+CNv;6#*Z$@pvE(nY0xm@*d3Kifa{247- z*>a7{?T>~zj-EM|EdMuBL*1+6^(*P@(}Mt5U$rLhR&EE=iXvxrKpZj(a z=YDYTJbuumP<3WQL~?jcO?9hhx5+o&?usq@fO5moE-2WEmhVLuluzO#kF;1@Q; zeH65~?$>;PR2Irv-M0K3vIVDaE@&nq^XKv1E+D3Np6T|K$0#8l`R+b@J#^x2^pWm6 z%TzoU_$O3TTlPDJDFGN3WPs0hl*K~oAOMRa+F0An<^FzTYgfgMfp zSeyX$B=y~-*@XbCLX|(eH^H_>z}IC1e4rO<=}d8UR~mE-1+enmtUH;f(nhb<+jc zxm*=X7i(>)At$SZ*B^v(kyUz(r>&-}ZaI~$X3d3Bl7Tf8Vm`&EqeElvJiW=!;lE9DjF@NkYO5(=pwv7l%7(Jy|eOoGI>N6B-4`Cef8L>q_Xm zw)MYF8(ZceUAb6>YQdKXBwR-QG74!-I6qp_6qv4x;B!UBz4 z=LEa!=_z#9YpBwkE?QlQM**lgY7_v7(s-qNha}|=x}fOC9fQB=QyVjwT@n={$}RWk0SfC_B{jr^vAfXH)>J}f|8;J z_Of6F&W)ds_^L6_-2=KlT{^%z$sdEcp8ADTAtIqR*S%64BHhc>EjOM18j)*5GOu?p z1-PQd330c7DvKjlM1c7=J-)xzPv)_S);1FLS`|-^Q5#}%$@^+ny+*e z4|(N8udB&o8V&TM+&N8DH?xlAE#sas?CRo>EgjrdC9TRsS|j(qffRvER@t7C+0`GO z36KwLmZIm;l@f51vxrpEPjCR6%JZNEj%z6~G06nQ9}|h2FWGry2YtlZdXr%aKoKQ@ z8iGEX-8~FJLyX5AqOw%~F(Vci=WcDeynll90EUmIvawGkF!h;_={1M0C&|+z$W^Ll)(g@D`pD0CopnhtW`knZaF*esVa{T zY$WHoFZHWD%lV@I%e2bFOm<^cMD?F5KjLfji>}z4Ni^)^!URSR`JUpdJ@{7)MdO$K zZSElc+1BROda;;*6|mit5EF|RH1e6v*m#>w zRdlg|n77(fT~XEf@nN53ee2RP3{GwESWYS=G9ro*i;`;SkfXkKJiAx+I`oPTd$*}0 zyQzu&H1tL=4UptyokJVJQQ;G>8XV@O^699R(W;#g81%l=`o3pt3#X%1?Xe=ThK<&? z$vq;KHikVC-(LFjU|N^%iTIJ5)XH;((>S2u*JH=KE6C(zbs{&C1;!)}kCT_?Cu})p z!ZHi9VYKP;xqXuuh+KL6wT|rsR9@Zs+{QPO-okuv8yX~<=d1q*eUHF7BjjW3^09n? zBe8oOmj%P~y@nLfY_j4jsi;_=�=|MZJPb@BQ-kdLy=W}nC=|9_ zEaF{tR%3$z4#xv!B-*$p&Z3tVS*IY)CJoL*43=bzQl}!U4B9AnAZLouSSrF26605c zp|bOSN2B(+d?|8B2sYZb-hG37Gj(5W&V& zda~+?7KXjO^-w6(j*9?A{ty1m56?044)H|1MTYt;)^k-DviC*1t{j&QI9H&*e`M|S z5S!ILcz%Si9Dbs@?Zu9-#d#c60=yYv+_oR0fke8Nwe24q+C7_?sFvi-vD1N^%oLTq zTfYvnxJHHq+5YNSx1mpJRNBQjNYppZ=+ll~vTG1%k#*^C)-T!?dzQAJhfi{`oVeGC zW}taKOtLsPI)@nFR!lKIPBYu3xu%u!aeKG;Jlu+ ze6c{+zTu3q#rzw39i@pQWx**3{ZMEvIg)D8Z9Pnl*^#iHq~$h$H>e_fT2^2eJbZFYC#;ujZLUDw$s; zPmy$nFyqKGjb6k)b6>Am?!jSa5#~ZSKf>pzAPt)@l0UNGGReU15M$8 z?aDAw_!{FzU6MY|lF!>X)WRBo)M}eu&eDd|4#Z#vt8U4| zVX3mDYFgT1QR6k8{05~mu706D9QKkhpI z)NmN_K?R3u#->WgtV%X+ z+T~U0%ZV&IfkNONgu*0voVey0=ybw#{hCntUV%!YD!fU&sH4QV`Q=$vJqHv?sx)(% z^_myHt4{?ejF2aTi2`H2)5zJ7rzPL~VwTAxH`jwlJTtK!*K{az#fV=3f| zb}GTSit`_zp~yriY(7_Dx2|A!8SwZ5gIqMDeLr2Y}2 zH_pMpAwb6(1ld+siLU`x28@VkkZkc~BC3sC-3`PaZMbHqzZ$Qzva`F`*;T#!bz*nA z(w3F=&4n25O%@AmB&2aR=~`r#&TZXjdoxwGd+bu$QlUbjICw; z{Fd4aC^I7KEX_4Fxd8pg6J(WZXJ;XMN_3gLf<_WQNhajjG3a<_=7}JfC^Jx`t}cT+ zI6*NlBkaP-c{6|GAA-ilss?wP;x@mZr1U8|#=DPW4mW>}E}HM+e>6S2|LoXYG`t(G1|-x*lJZ1P@GiPFlF108t+>TYHQ=OeEY-o7vG0BFQEUbl-nPI z5L7a2C7iU)L6;BjaLBw*ORbqLgi>HF4%$$B;=+vIfxNX^%Psj<-)CAr`Vme+S^w{f zlA4ue)u0iP^EV8YyayF`?2ZAGJ-zj8^|fnFJCRim(T@1GK^I{{*3MD7*X`~HSKWmS zVrdL5qFlg^I2{_dG^{0#FQcBRn+z12*4@yK=$^FNpC5wz?dLej3eYum{UiP60H{RG zJ(NAzPy-yHNWaD<<^`eA=F8ntpabK(H29kSa^aBEv$J(!0Pzv_7CB{qFRz_ffHi81 z=Xu}^`P-7J7GK85sgUyFxgUb>j-kSHi#%(q-zy6vSQdDyE{`lPhdyTPrL_BBxR_Q@P*#}A-pv$Z)tK@g zzm%)?X4pi7(usm79kn4W#Qbh+n2Do3`(KHF!dx$Y2^1oCX~vN=RuH0Nn|PQ(C>jE^ zAHr<*uiaMMZQ68H+%v-9ut%-n1N|kwGJtPXl)dY!O4zq2Ql1-fCJE*7o5&L`xya)d zFz-btcjbtcR(-_2m1P%}cxZ6KI>f3lbc6L;A1!;+jxwKWWxz-J5EeI z_15bQi=5~2V3P8A{X@fgcuAM65z1245`_=F<`%O9glUDZm_!&}hLx$3OLc7TR3g0nDr{e@@(ipD zu0U_&z(+*m8u%$G?HFD zMO1L|3w!vSUBYe3$7&qyEOHz_IW?XVYX4Bm&vz4WlA!7;)H&~X;vR=G@^jGQg{!&Q zVA0g-I*|T~TH&o<{Z(imx$KTHz;2;Wkru1OQ$$iy#6>OSnPT?sh_4nRz2zbjOOZZMW zs+5ucB_LYMabfe_F$~`Mn>hv3(SOk+CLmbDPnn*cc5)B?L1(ky1m1xVTZqPF-o*MiE4mBP2$IZhLINedAJsp?~DuN=aXfEt{Zv1)?&EnR9RD zYBG=$vwZnm*>^P8*^#~q+)}L!dm|ql*!6>6q^I)7h?Yj1l;m(6RIY3lqm=MI%{)D=61L>Z3uTkZF$B^R?(ey;@-$r&buM zZAZy0u2D!a0sg3<*To!k%~@HO*^4KO%l>XorigOm3!&aImEDR@q{D3l33kl z3dmu|gP*;gt)fb3KxdRbRG!mW)Itju(f_^7qn3ejypHH-Xp1kclpSTH)RWMWWwIn% z%rhiX(vA0ir0Bo<8FzR7(Mk}+RMns>TqTd>EfI86leMOP`5XW)W-6LGa@x+3V@V4O zB@ftjv~O-92hIX*9i5yIB`L<^5=TW2Z0U3^4s)zZa1s-%*Gu)F_bcSkRsZ}Q;s7s% zih`HHX%=7_bVy+`2&v$d$Ht!En0A%nMPPg<%J^Wm{ME;LLCi7U&htbn-}@12E3kd+ z^aBv}(R7J>d6Bcrdf8b+u9`4XWNRyt>Oep9dEfH&sPxz8Ck2hiGHIxOll+6;-do&Uv-^-WrF+aVJ8xAHUnUMhPvI)g7(A|MMg6 z>xv@o&ha6IOR8pxHHb|;g554`vBsHrqkQwk*cEhYZZkWx&|;g~XMChgP3~$e$&f-{ z{=;Gt4Wn3-=q@0)(=ag}(Y`+=B;}9gn9O9#pJc+1fwvgF`HiJ1~)STe?wg%kiqgLC#2vYq6~VQ z3#+EONK&?QV@S_TSe0fHL%Y>z9v4K11@BxEbyF`)9$D^Cf|`l}W&joZXFCzTCJ$Pn ztU70W^D$e8@+DWrVG-v)uBX0o|Hw)4@yHO3OWW;qBmf6nb9@u=PFvnox1Q_(Zm8ka z!@1=^2Cq&eTV~CxT%IX?)^)jAdO&p9D|Brf=zqDxJhuf#OKji=EEdJ7Fqhv2RT-DxXJ_o1$!iRgq2mf)m zBM}4w$-LR4#Kpy(nHg($d#Iei|00+5;qCep)WFIrBHDlO%{bxY1w0eASY zM$u7%?}c`?C;htyA^R?BexN6W*(dy8Nv-c}#ri9A|CI$0CrQqxCnbHZY?;5Ch(qwL zyX}_GaFvnc2!%P-=)2TqUoJ9Uf3m5Klx@w`E^RbGM`0Cmm2@*QIVO}2&3UZcw9PDv z5$HHL3kEqmqe#+LWM!97>>cldugyWNyfTdTJ+vl9HUQ?+KYmWH4< zdAadoc6D9xehcd+75G0jaD*Xr(5BaS5eQ(&HcN7ceBZaq4IyXw8j=rYny=er?3kopO{mOQ^4;S z4XOEN=ieM({?ob)GUc7$W?xzuR7f2&v#*dl+?X#P*Ku2vLIJy+a%eN|Pj`Kq>CQFv z3ma}xJUF=G)qo=#9_-J0c~x?%g6DZNs_@qIk?DiDL}_CSyiK*Hmm@C6bOcM%5#X@4 zPZax4(eNrc@>?cgxDnX}=|xpz<{SA?~qx%rc2?MA<+)2&&= zVYGIux^;1D&qkHSmLpJ4Q1M9LX?cpaAC;KPYl_W0b5_bdR21wiA?3mrW!r4sxl?mD zkWtVmA!HC^z)PK_p)4d~?_ZtmjwwWq--EgB6h)#^<$kM6;G(2kh%j?HHCNu@(y_5| z8a$%w4fxKuwjrn!X8n!c?;|`e1B*0CU%wt|cSj9Qte;t`$%v+CJv|64@X1U};-cjg z#eIh3eMU}^4?#fCEBEiHpdD0PH9x!^@7F1WZoo&;A!{dT=A`dYWP&Fj63e+TLc5|Y z1n7Ekod?cP>C)xI>j#D)He51l^_e=$x!)?kD<3xYgZa+gPPh1H+rOs#Y*H3KP2Ph` z2#&4@8_9h7i0tbKXTF)3%b7$UE5%KNbSTGbHd6n%mdiNJ7LoH@DM?FXM${mdjj%A9 zP;`UF=7moUF3zhbHI~-SoX+l}x12pFrIEDdjqGM;x|u~Tnzp`9C|utO-d8jW0ne>m zPqMMf2{>>T!W`ymAJI2j%6Mnap9<_}c_mvzIop1k{%mW=W-z~Ia#cB|?l`{NRuH^P ze};%kj9vY)tADw$C+<5CRcu^!yx?rT3TXsME&b{TX2@?0KqqSAlB46Gl-p~aA~PTv zAfZsg{Yo^kzzw3Qi!Q;v{Z~(i`@a7=P=PfC-<*CYo4Dy%sH!@98|HS~M_LMkQfvE% zv{B)M-6~U+;*2|b@+efs&| zdBR>jyxi+Q&W3ny@}z^3zw;BFNM{8?fj34jL9=6DF>qXci>BQ-1{?|MWhx_*p1MQk z`CAey3Jo(YpUEY@R4kWYmv&dVWH%;UsB@I1ijAo^vGlTo{%FA_MGl3yi*3rY$Wc)IyXEe<_l}iCPB$LWUP}t=q+=AJ68)Jq#{M{cOV0yOm@^xZ8$! zxrBjNe|jmm9pX!}4^teRBNab79${TQ!%GV_HPR(gvAQy(WnU)Z20=%XPVD~Hx1Hp) zM5p%;#U{?OvVIL6M(O%I+K`cR_-ypZdMTrFTn6s?dJ7!j4NQX(u433L2%W#txeO7D zL|);@b+Z`9h|aauh3sl)y)d|K5dP8f5w z!{83IGX0_j>^Lsi3y+Y|n9w~cEk?0GAs?EgOGfUHM zHZ>Mjq8TNVf}o_sl+PU9p*xzQi07y2-@Ou37#hS-XUL^239M~wETkOcrYtc=|AU>G zMxt0Avu?zzL1)RS2KM#Wop{@ROWHiwc3E_QQlxbphK0FClt)cD4)yG##)fH6C*f5R zVYS!eKXejYUk>wa($EUCmDjPgZ1Y((p>JdHOa$dZ#UX(qhh7pgVpgx+2HXs93)yl4 z;SEVk12;2Q+U63Ag&ZGe3jE%7#Q78M_-Mau&d%Q-rMiZV;!-R8wR&`)>xP%l56$VuX%hrM%u!OC;E0pba;K2?;>Xt4_QHlhp7bP>*Q8ufHU?Ae zp&RE;;ehdi!ESJ(sNUkT?eHg0>F#ryLO3GNfSp9Xr7TRT2FhUr*HwMPqci)Ky@Cjm z#M8o9nnYv@?3nKX*kPkF*k}N3sC`UEW#1DbsxaJgn?D}p2|FZiDll>?Q8fptPSv!E z(8(fD5>6--CwM5MC;zU;Brf32>90}U16RYnuL97xr|IW8-U9v%E@v)wI zz2Lgm5XF2su!|2FkiT;;qiURK)u6|*ZKMBtkB+eHQ0owCyG;Bm@RB#Tq+IY_fmNTj zwK?KbOBQ{1+=lQlbX_8@pg*@W! zntVsq?fIpLgXQ|0Q0#z*&zX{5Q}pe+1E6CHC2ym{rTYCwwdLt$AN`g9Vxh|d*)H!N zio`tPg%nr~S*haFKLbG#wPo>-nO?GT%quW8f7XZnt`R|srJ*4yedEs-5+FeR)aeid zow@5RgqvdX9)K-}1@nkS8Z#%lw8T|dQpqg(=KDrfAVJf$`E9?PqciATT^9%woWJrs5o-Yv0{$ zWQ0@g>C8&nWdG@2+W7t5l2>KtdK)01NK@9R*>CA$DoUiZJ*VAZgULz8(-o>n&_Tdv z6Qf5BsM*O8UsS*ISMaUSwVV@)@l` zC4OQ z3*;52s{d*1VIyOE&|slL!j^^!^VjnZTxnY<>6swwv8Psx_G3Oho?BP=YF)dhLXNVF zn(ZSmq^cZ@5*-!lesL#>Y?1QaOu|Yib}Hc=avj6B9<)r$U&bHBVb1$3861bhhu+(Y z27Zu0{>z57%M?lfE&Fkb-pn1FOL-O?W!}S-FT|zat^Z;?V3HhH?~M2rq;v;^aV-pW z88ZchnW)($&1W~5r+Izb&2)yRkQ<15waXT5a1ZPy91dKFZ$IZ+bA}j_G1{sI?0T_? zFe0SuN-yj=3V?YXAHG*_**Tqv(DAT{MMp%Aw79-%0fC*<6h;UsCfU~O7>$SVvIY(Z z?4eBjt(1d-R++3>1@qoXc}4})qZ&Hl$3C@urlQWFNlWu-EP#pvagrgRw-HoYUUoCI z9F(BZqe%Fe-4NaH&<#65tooBevm*DG$!cS|os4H1$!z!;;s9r(kXFGDhHmt*YXryFeu#XC zt#|3PHz0r=NXT> zWPvfNVGp);E6}8nh|#3N)>NuimZc{rvAIp1SCgl;zbF-4^7~dwkATgjh-Skt7*)@a zYq*JOX3oE@=JHJXZ)yicyCc97xCn4=^{pj-$(YkvTv!OmJ5!V{c75+nf|mVm0|KTg zM3`HttEMJ#ML@JZSpnNqEWlEZ-1>)TSQ7xlk^on}y7;;e`Y3|~)46w=S1ObJeM3V* z?az4?OOQptgiA*enx^MXLtVQgvCfJoKn`Zu!B*O^j`$a81ds z{6HEVBMdfYjzy*&RB{$p^!niiRLWZP=J8Bxah1kXY|Vtg#+~K50|wt2sO#u6Ba$U@ zGCwwHthQMiN@rG0_lp+BSv&h!$r($#j|x9N*0Z}#4W_HIs`{Yg(>dl4xek0`!|q#c zas;&h0ZwC?XlO1wBT_n6io2fnP#EW7svtUUyq7JK{F5=-Z(p*3K1e9wgs*FtjmVVO z)78W2V5>B$ytI;+_qRpOwK_$p^ofF9yQi6JgXH5F`8AdalXq2|C2hz~59~(YGq_t8)wrpiYVd^+fRp zS+g;qAWktev)qjoaUZ5`e`8k4{9rgX)7M}L>2rIqc0U*%yBis}~&|92yvi&l^9Pj}chlWZ)4$Ux9j6xv%lzx)86v z>1vc<+4=LOr|W{!dHqT)N+%7wW2>bD;B2xgO@G>L@t0p0s~TquDti6?M$b-1k(7qk z|3Ybu17nE_3M%?dRv%59odSI1(}&s9JyjI@0P_x#Uz)}e)l+eaH!u=aKxmh1+1dsM zRu)8YtwkytxHw1Wu;89T^FZ^7-*X>B$7u3x+mA_M;cVd>!i~P0j;WQoo9m~>2T~j1 zD|;D}eP6@ZyK(N;%xynx*bu~zYqV$p5BW||6XQjAWuK+pokK+}n8h_Nxmx0(CL0lb(;Z_|26$^a_QRT#o^jznH3AHhV#63O3 zVRkK^w>Bc!n-=x$me!Wu9HHGh6+Xg0IDZr6Axqb3Y`J;CJ!?oH21C{_Xk(Y^T!`41 zmt04vwWz+0rBn%0j6KKJ>e!g4j9(nJD;LTg60!~LCf169~Nlv47Q*Q zWft$~b^B^^jtmdmp>DnT;YvkE7odLf_HX88LDxO%dIudSG&B_P&A6>IphBp9Ql9Dx$wW$<>UgL zc>lWmM_Gq)VKeeAyEK)QwAAFjBwhj;jX)O{O0DaNL+^D%A~%s~Y4=(ooD^f;6>;6v zG7=K&c5XuYxQ8>c|MO$m?7EA3H%SA;XJq$ux8C;Xr6eWg?nX3_FIo`*F^({>8fRD6 zh;g|a-)`;;0&qlW^UG29ZiE^-Hd)6?#QsS>0+fR-ObC{$uJhJIkAugyaW3s_oSXn%KKhgKWUIm^>!v_QnA{gvs_e*dAS@Ihe0?6T^Ei_w{a40C6;8C440-%Nx1 zxJ||2Y^FgjEWezrzrUtIu}XsWMlkJzoq|?-R_(Z+ke9NT(8AP@q`y6WT}QPMSJQv9 z{s>iM<>loGDWIbhU|zFQQt$=O%9TZ(Gc!Ll(ttEtuxJpjKYvaMjrlFu8Q2=OaPS_! z$y-*ImzFkZ5*8N$)R$0DaMKYoP@*A*0Fp8>iIuMkVNO>6qCa7=4;Z89HlH~hnzrhj zgYXtcN^K>8T*mv>o`q-eOSB#f96A|R%T;Z8?AJ(Ee==TQz_t^ zSa4oCT*n$o-=U`x7PJu%N|{t@Nmb0Q=tLF z(Eml5@j+lyEp_F!2AT7py3X*&18y9w%2 z99OXToa9j z)aca9{cmvd&#Va8q5>(#HmSsp*_>uOch_O)Xa)023d&VB7Zgygy7pS6_XAHDh~&fK zc-4lEZG{F@)amO<#U*|8EI+K*exkA|kyrU6@T*r|4N{byoy{~;=Wj>1QubfC3-c_Ib;w?R_t z3m%}dmU;Z(>>*d((9nQ%+3HxB7$R|6R#Abeh8$&9?A}`t*w|!bB3?Ezmz4gj;?w7s zTq34xoDeeI`Ut~z0+IxnryDo4r&WjW!w`B0lP6nG4Mu&JY;>64T=va%}c z?iyZCDsb0ZHT#)@eVpBTV@5Xg2Xi%0fl_WU>;R=))g@Y{)p0pY4{GEsTi2=sjrt4-6jxNRUnGi*6G4ZG+L^u1AE^k>nSD>oEUqK zadEPe2Ww|!VwzYV;}H`l#&^qxqeP6+VV_-kc?+EzF$wT3Y{!V_#oZ&2?G8EckAnKi z1j&W*1l?zp1pt=#ixIJ5O0hI$Wo3Uv){rIa+1YQG-j$SC9)EIe%tyMb^j!Gg5*BjM zSB50Ow=?OG={j9Cy7h4%UaLv8J6^^rI{u2}~s`SlFe&z*&-M@((sL7oc^|AEjsQw$m|5%)r*xg|M=i&|+Q@Mg1~0$%MUW|8q)x>+D{7|N96a|7S(tIQ<{rwf`@F;DY+LvM7PAWeA_#{6nE}Im4vR z2-YmvMSaiasp70*Xa1PT6Ol4_lH+Tg>x3PQ#4hlIlPBNiH7J3GhGt5H9ZW=*AmGCm z#HL3&Zq(vQWN8=@hY7r%f^Onwo+#gMLNU;2G_su{uH7j7oGs-yBhyaett*TppqEu> z3vSj=9R0Gc7uezqhi(|aBART7yGvU?Fo(gVDV9WtUf?A<0-E{hs`PKdv^{oJ)b3uM zC@fUS@$I@7?s`>b(Du|+WaEI{27`?3D8+{!i`!#IlzYS6){zg&shRP~u@lpNlrLAs zw)$+Fq0t?izE7+Qzwo?nMi%U0Sy*$!4;;OHJ+QJEbQwV`tgaFS69yGk6)kCes>?(*y%fhe4en-N1CmTy@)y;mr+}WG zT0aLX)0mH@huRWGGKJ?%gp0ijv;&dy5;Ucj))hOd9O%SAG~!n^H5DvV@;pZgPd&4) z2>y<#sR~p2@)9bDw9GKQt%&neKzu|}i(jaMid=~x^w^8mVo;(d?>k$!d%dex^wrnO zWMTG^8LVsaqN+d9Vcph3?&bWRJNSJ$-@Hw-%u|&%Hy1500G~7G8{{b}gx^g;7$ZhC zl?0}jfT}QBXVWjcc9ER<{UuEVW4{qW9+$%p5+Nb9+v+& zxj4+5Kh-CqI9sK0Tnbl6l=FBTE>VV8ndJXo?J=mdXsGNv6{8BvX>U5cvQt@QtU=?h zPPP{ErEpX^{~57`6<{%!I65J|M=koiadhys{b4$W#T6CuS*|F*8I1d6^ZH2W6+jCky5*GXK#q}U;+ zB@PgL`vLpw`w13iyvnxA&wghr1$DNS?sMiXE=&2JjOtC+?0s!mpyjs;Sd@5bbM0+A zan{G1F_to8gAt~Q54C{L1H$>1tSJisA>0N=jJlpi{yPs_M z)4n7tyz?x(8t+#Uy?7)(+2-(7R;*SVJ~0a5kg+;^3mxwZKkvY&iBv$Ds(9z<(>|4W z9wj+V$s;Dp;)`Dz!cnofgGZ6|#nMq9n{+X6`UOD(huM1 z33-jhrzK+y^*I}}PshT~`Yd;skOv2Jf{u~c;k2z0TlEiu#Mh^7dg<|dlFYPu%%a;? zR%SEy!5~}=r-N!+f*GYc2~m8Uu`a1qQ$KD=o~W&}!>{n{qy_nj#e-dSuB6fQk8we( zJ2|A5GwP9}+1tYNC31U&E9}=F-mGPQ{J2ZI|7gzGk8Bwqz0&5mc|h1Qz^YwW=YqA4 z5RPR=d>A}&(^5!?Y5+wx{d}}){}zSk91I?EK7@P6doSqkllIHE|AqhQcUyU2ps0!( z1tGF()3J^l-B)~*RT_&fxtC{WJT>?^)0?~EJ6D_6b|>q*cfnHGdl=TT$xeK^_By`ImxkIN z*IGa}t?%(ypH9L85y%&ge7w(3?|@^XKTEPrl*7Dk8Q6Phw0QNej+6pg8{}P!MGYUL zx+TAQjvwj`Q6&Cws@DylAKnc$0gpYHb(8neVVssOWDx~PDDMvJqU^; zVL0+~>O!M=ZmXm^j+wA6!-R?6&g5Z+99*%-H<^x6j5IXt%imoa@Lvb(%@50`0-gfy zuDC<_1=fnwrXCO@0?h3kU-IS7NROjk}hav_^bjHBxOkw0jdCUPj9`TKXbOL z8$#(Ea^&#tS|V!et&9q*@}^T$Ine_Kk}ZkE1tNgwIFKpKPsb`(?yGWZ!@Ec_jx zb$i>zb@rt_SQ-0I=NMksgeVu{7CF!xjbBXJoCv}yrCu$t=N-%!x90I~J_dTR2-URL zD|zmGq_Ypkxz4_I=>Su?;(U;XWnD&PXC#vsk0i zl6Y}Bl9a8>TzL};kxh}C2Go4n-H~Xr%oAeen>3_aP0T^q9N34>D!i+!3LaowWj0S) zrK7|X5~@spPD%9&a141ok;fZVVXlaq;MxdEXgFK6ohy0Z$a!B%xJYN0@b=A}I9%5~ z0Tve;j%-BaSmw2?iOpqkn~}rKusOaJm*<1?8Mpvv(PAWGETd^BjGovMgQtUaL;SMm zAxGLQEZFu-y}P6jA{;s&&*b(nZf-yL*fn_PQ)Y9|bwOZEIpby@np`G#Z~W1oq>Y@t z6>V)>mg7aK_uM^=w65gSeU18*5^1dT;Kuj3fHVTT^`$^@1{+Qr433whVrdQZuiTNZ zUM(L%a{$v(5cpcY*M$#o-qpks6SMAKKA>jVWg{&=Yvz3iK~tn-y^M7 z8c(b@MEMkXJ1il)F$p>5kh`A>ilbPnNsmN1@zUvREizU8?AU?QxMSJ`!Si? zd93~B*UeWuT08AG|7bk#-(+FPbWfa`j$f6UT_pIP5myMJ#oKy}rz zS@s-_&;Zu}|HcEBTjWb3D=Q24I}7tobEpE9(JcwA^mJqU26`1bIyw>(7WRLe#Ummj z@)ZxS`tb{_%525^_nVuWn=<$}%j@gi!DaBUdbAQD;8Iiz&jR_<0oGkw4rsTu2*NkK zFGO!YbARnqF|6sIVe{R`Z+jKtgp{TvL0!{0Hk35ytVAn}AL? zG@PuY@VNYt!8#NzLXB7C#Ls*>Dh2w!Jq{L-zZ7;r8e&F=zzsJ1_-KhkN1_haVs^Tj zT#djCu*h^E={x+1L3%atB;)f4m1-V5-`v$abidk4qAD$-I%eu~$*ycFs%=?2p4a z{IbBh+=6twmvThWWGl^_cN2r%YEt0O7UXKg; z6e#>y(TV@t|AFRm_~DMHlw2+Swg*?Vw3wjjl?s2msWM)NtnPAdl&?SeJ>Z5|)ENw^ zPyRki6u|Y=3rf&*1KmHVIm>v|-QQs8s}?P&x~7@(388t5mB#(?TGZ>2RcwySix}RS zx;^Vra-Ff5dEWWRrps;K>V5rErcyY=%*@?4I>PV4L&TAzlawzV5B3w&;h||0d!V9M z8H^qs9Do!L5chp(+)FFWQ?Ep#5n0*&GdLv}Zo^k94B?}y zH6UMy6zd!7a57mChmR+~=E5vOprb42*faSzAW3%Z$s>Qp;NI zdg?8+j8VP}SryBO#c`LvAjtc*GV=)c(M%`T^5sbw}Ga@I+D9LH$S z355Nx?!GIki7xtAKLrFuK6(cM1pz@M(wj8ty+jB_YUsW94w2p=Gywsn_s~%~hTZ~% zfRxaCui?h;u65Ua{lETS=IP9=Ju~~vnZ1AIIGBBSsMz6oJW!*x0!Mp4*~_>d|Jqz; ze@77GsZf#j@1TslVp_^~5ezc&bc&mgtM6|2s8L)&zD~k@zdZBwceuv%>+y9eGd6*I zmESf`rpNC>x_ubny5Mx>PLafVNP|8J&~6XZQuawH#PA{ zD!{HPtGb#*R+R)G^WE}K6Aofc_MaO0HIUlGkyo32s)iF`T%A`983x57oXKs`MFF%_ zToU!1Z~GV)!6=fr#B@F>1%1!?v$g~7^qVdU2U8|9R?wLl1u&}fu3ra8CtY_dLi{S zOBvzftsB%UEG~upSi?kb&y-=!BdaXJ$tJ8>(0gXBv+2ucoC7kJ+ssGwU`CTsEx2X< z86o)I_X!>pJgwn1z1-8PVqJw~()Lzy4THd}mDatT|P}7bGBD!rJ`Z z`SO>8!vMG0m$`V&T-4l;WIgv%vwzil7GK7Z`uNZwFE-&^XD=%p1_q;A>m19nN+|J5 zylIzX0O^d?e$nV@P8(ZY!xIkG<~GYRPVr31(nk`EB>gsRL{%# zqE$gwrtV<$&qOaD5|f&nZlcc4{qCBCtd8kRZ1vD9#{_X>eg>16Mx0LIiB)@<0>AO>Z)g~XPIH=Vrl|BV zIqh?qeBscHxILYwa1}sbnQ<@Fw|NaFO+t&=Wz%%ZT$!B{3Vx|1sYB%xkDxk@0x(Bs zu3nF3#B*yt9daejk>WYiD?Qlt+a({=ZGpR0F{FpNmg=`>cEcpxx7CMA4`rV%;7Gn0 zrAGH5-Q|_+hqP6mx(LFyCZ*a7Xx;2{0102ezY3}8OCSF1@@*zE3BQQ_RWaH_GEA!) zZb8J?aT-`7m)@JN-PNkGIp4MmVFQH}IgZ7tQ+J0?Y=Q>S!$A;(Z3}Gdpq~AktE#PgL1%!x+T}P`QEt4>SLxm2orMQqqVKRD@WOk3TUS zUh|anYk}`wFZUsXorVzYlmU>OYJxk^yEC9QhL0F3;HUhmlt#pcRot&svD8s)x2?@{ z=`=zZS?1}yNgS>bT68Ke8ZgG26Wz0^LA6{?BnbGh?If#bt#ND?`Qq2KA!q1jD!R#) zqtQZsC0^2cxWXY4=-8HZ_da6?uwMDevQBHiK2XxoMBB#t7#c2DQxZ>^$)S>~Pz*oX zNZEHv$UIF_?#UAJG&56LUH7g_DkYWeJ*(+bz47`CAUUNijbgKZsFv(c_$~HUsqpP< zRn-1oOF-<~%$fRUjN+B~IEIt@lIbM5Lsh_Z?cRr4#R+;Sl~|@PVCKRYSr|%*l5E4Z zRAcr>QA^`i1K%{Qt;d(|m290tZRm*UFG5p7#&u3YNLe4=N~ zhnZHbDcGlkk~pY=4k&NeLR?XX5*(M9yp-+X?d}`FjsCRuvNAHoN$L&I0d_1_=`+iv z@Dmafr}(K>{du0&X<p%6uPa17KrbzQa|<1a2#G0f4|RX17In;Up_hMi+NKH0yS&`X0n-?b5;n79 zcjXz}zly1F88F$17`8-OjEof~a4Y9Y{@&KyDn%p-R{HkFgb;81`ZI@go6^p-&3=e` zq6RY@ZLehMs|VVor(%j#j%nTPRm=H)R&e8=owLD7#XMpst*&BFMB6sDyXTeJo;@PN zZmG3=%|EHZ`R{!vxkTSF9$FvphAG-jz5b&7Lur3olX1AWkG%qCaqjZX)GBfi^kq+= zir>l6!A9N*5ZhO?M26+)^kW-N#12w_ngJzhbO8BcHJ3tE6%C!lQI7~sUMGkiAn0=Y zQqQ$#@?(jT+;hgb*OnW~Po`T$Pr)i-`a)_%^n#};$}GQGq?ij=uD%QH%qAB0JGPp= zy+FCfo{D>{g#8+ij`cEK@e@n`A$*_sJ&sh@M>DT=joB&; z$+eJHVtyU6&mbV^cdAJrcc8ZJZ!dZJCiY$)#j|n@#kmw*NH|^_Tb5Q!8uV8WPjo;y zivJ60q4Cu4FFjahiQKyzY?V}rr}J51WXR~*kcm9nynzUgJKUTnW+mClvlln%UO3K~ zZY1~HAyDEr**STB%R}siT5Kx2k3fP);2QUZ7crF}hfn_|6O|4JZmOmHc)4)&Jvexp zRCBt`=|Z$6xZ`4A4uarX#X`8$20rJ0z0dJ~xCInDM?QP!8AmVVvisaj#E@6erRPP- z!y_|;=d=sY@#F1ehsF2T-0k<{2Y(h_N^tkvE3?@9Q6=?9`)A8dLGEYs$~6qcJ=P$B z8Hvj^X6tKqkLt8Eg}M1|*9J*(affhF6vb*?t~8>Jqp6GbF58dU=e~h$4b$K|jYMVOk=Cu&WsHKAqobXSx%}gCQgF-k)+wQ| z*sE-vW)0Sj!Ldvs(s6E;v-kn98=Y)(2BVN&g5r#+bKs$U-k(ff{-#DX)2MNEx0R;g z;9%++Vnsi{o5zd6BF|Q6v32d=DkD&AI=Nr5cD*%!b-79_sFmclggVX?bXo zg2Q%LENu$E@k@cJwo&bGH|FiVUzTV;D4MJ48g-eR*dZFj*W=EYzWiLoJhbh|aq0kK zu@AB5SXoN~*3RpJ+n3PLN48k7`ezwd&O+&emCm=c2s1r!i@d(R&Jq|j{QL}C0v~c< z-GsxP1nG>8m$0ZDD>l|$@vsE%msc+kCdT#19md;8EUi5liB-%z`HQLKIGwT6m__tq zPX7NY8;e0Z{Ew>j2M@l|{$Hr(g8)`Qjm2;NUf{|{9|W>BE7&G61%Yz?bN}KxmyXzO z3wVmH4-Nlf`4*a1XZjq|{jp={_j;`+Kh@s>2M@ch6t_)ti{p2-_EvjatT_xAK964a zc+K1i)6mf9?ZjGH+t?L%GTnI|rJV(4!tBOdHxpoXt2Z-PNTkj7gP^g({FpJQwDgl4 z9!)KvjuN{G(`fSP;R=nnEcq)O3mrb{Ek5eut4_an@r2T^cYo({nxJkzAJI2Ij8M~9 zQE5l8`h^Y^I?x~ew%7wE+@RQ8_39!weWK^T&yedCl@_;|PAcp+mGO+ds0N2`kIr8b zZ82l<1Wha+RI&@D1|R75tf);Me%9_%V9#{eqsQ z&2wC<=Uw&mv9(gr7KuKuYJ+->*YgW38>`|+I-6cDBz?g(owZfthsZ5_^%d9S>p`ji zLKE1~ZbMY8Dt>@<)>1QJ?^&jLmc>OL!@vQCmYV^vf^}B9;4uSWFWSYs=w&iLK_p>9 zx7Lf?gqL1SQvD%b*(CgwPzGxa+N;3ZHUdYQu8}*z8~HySvK!2soWq1tl|gG`6KH)C z;ip_QShdBu7q@sG{D<^r+QQ*QRW$bPWIbHor7Mr_YTcFdKlzrvp};k4Bp6-?Oh00W zwP*xPhSV72GG5MximY7Ze<$4-mLp_f>%rKt#FCCr0w&5D^AJgkV*vy82s#lN1H@W6 z=8#-?*1A+w8a)xd2E+AH}U3mZ#o3L(-)XFSG$E6slS?awN#~6!7Z< z36>un0q`lKr;BymU5aY=SY`?AVb`2c^Gb9$Ka9GSbymXn$n6%BRP zwl=IwsUpS(q%6h55^0ow7nU{=5zl#0$1PCz}?2AqN z#?1pfKRpo!*@xHLMik#PY65R-XdGKUm4!a_X(zjmRHg87%9D`SAd8O+{*~W%8tE|_t@4FEilN>~!g=b7(7>APD=bLCi;tAi zq|?b7}Y<21P-7Hgt3noCMMBD2W_u_%OaZ<;NLF=8A~UnRRnfZv+0TJx#I*MBE; zkSI+b&rAmI6cJ>MH1Cq@($C!T~HQ>Xx#VjX~A}#vmRh4QvP0!pR9*T#mXHquc4F2(-#$kWCS`oJtr5gTaS zg#&f<@kLat2km0MeHW;4U~hf!@|@ij#K=1~Y^~H}n+{YYchIM_Om>h(lFm} zrW|=G>+89<;5&y8Isj8Xd~hg$T?ZAR;b>~oNT>6IpB|iq`~(fDb(V3~6lvocKDak$ zT5sLYn$^>Iq#-B=F}=uK^b(?g0k7rB1I*H5d%v#t%tN}s5`cM6V3c%Y&_4tK=s;0Z z3}NHH6u6u+{TAG@DMobF4hG+trI}S>ZgEO(AtWYGqUiNL(|j8K_c3lrb)wN%E}ogR z#+1nmv5T9Abi|U-0o)>ULR>!#(3zKTEIN84S`ry}xh|H?P)oVI8+A0kEc~fPZ%^h2`h*ckaSlVXF)}^U1BDfjSLGUjOtP=H-4%W*s|8Yf@2^`{d zakGexdKS4&iX~}{!F-;Sm}_1GK_E^L7EH26tK;%kl$9md*flYzqNd5kIHR*{NNbtY zJxy(UeT`ruWU*{oKeTzN@voDMg;vGwJ#DXj`{Sz+F6;0Ybf?870o_~pJ*)W5#;JSD zAFhpN_MZN3w_SJR{o^c*65p}mCEgh(0y5g87M-;mZ(#+z8EfdI*O!O3!I;wepT^eXpDFe^LveF2;v&FQL&NI&* zhx7&4j>d3qE6SL%i)1sVQWE;x7`+&@ zW{p+4_j%p?fHph}%Kv-*uuQKz`WuYeed9UNOnoZ3Pj!i}Di&AMQ+bzd&kzr%q2>l> z@m*K3hhfuSo8y&x{h}skO-fBdu=3y3zpW9#Yxc9;d*J>W4(Q^pW*%&+pBENVb@nmGpq#xKi1dN zjmvHjdv+&RZRgdVQ(bd2GprC{mo<4EozydEMFKQe$n_%yIte?QM$SD@lyQ7BDVXY} z@73Q|tjsvJU42+g+KcP!o0`6RZFEc~232wHzvj%jXzwlK_RL6+yR&pyT;O7}fg`xF zSe2bnbJ=d}T|kupm5srbR3-nz9Pj;W!MCPTRHS3r&TmkyDbB=}rlzwbEv$PZ?lKi_uo+1@On91(+-sBt7P zXu6C2WvmNmZf;H};MS`w9s7Z}RS?%3?m(YkKHo=ae)?okZKo&weG<8vWhL>K$gQhI zxN+&Yo|Q9fOvkqu&X!kMcAdk&xxA70HuJp{(yMQQ_dYl=oK_hi=)6)d^Tv*G8wc$~ z(9Pp!sP=M#(e{P;i%DAJ{C4+mIa{I2s);yVA`f~lZd4CeQcRr=g%KZ#1~h2r+* zVNLk)3t!_UzblusYP=HFyP2_*;Ljto{VU@jx{+O3!G|x(euSOWPU_vm5sgAQEdogk zm!@02PPJDD=*bc^X0xJ`F7OWhh_ZV*8qa9Xsm*UV#NAh%XWsXw5`;~_0UC~FvI$ib zjS$K~XlBOY(oY^QlHae<|3txXZW3EZGkdra3q{ zk@MHvEI}CQ=aH*_eubWsGGj-IWWv!{g|)D2s}2x|RFm&wXSyT9o)FYgq@XX}3(cBj pWFva;!MNrgq=Mb<2QYcd_M`%$dceERi>=HbD9EbHR7!mg`9A<@Q2qb_ literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-supplemental-policy-rule-options-UI.png b/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-supplemental-policy-rule-options-UI.png new file mode 100644 index 0000000000000000000000000000000000000000..53b924fcd9c1b8d764cbaa12ee7fac6805c47ad7 GIT binary patch literal 59172 zcmc$EV{~Ofvv!<`jfrjBwlPU2wryJzJDDUWwr$(CZQIGsy!Wo}&;57*d}pn5cJ0%> zd+)C9UG>yc6{a934hM||4Fm)PCn+JK1OxF)!uqmsA~P~{}f z$@dAEsi3SN5Kv7F%)37L_c@fEgt{XT5VF(1FYu-bz8etGVT+`Q;4e3w^9*n|Z1L40 zXWgqx*Ncq@kEO@aaoIJJ0v4?wj)49!&aggM7lS{BCMG6{R?`1|QxzL&l1T&4KTKSf z?Sm4I5QinWDU0muHFUNg1Q&+U1Lj(vAe}L^~3igKmllplC{+H04VCU13lgLmA z36BB+;{V-Ep0f!}F6&PZMwjK;`4EFS^5SP!Nsi+_1lYgkOamKgKoyNSq^2t%&fvGS zR3aVQhL}w^1BNeq@AaJ%5p0#-)XX5}oF6g~SE!u_iTMU|$)?&PCDm120yRo3ad9#7BSc+Y-QCSCHg3(4d&fz=?Ca5}d?85VNi8r+*8H zDgi_N;R16EA9Qx9a-ocsO3e-lYL! zRRzOut;*SKePDX3Ux7KeT0!6|Wz%7Eu3$ObL&`t41~JiEs&YF-lWwutWXybDEogk$AbGr**+VdTzO9+J9U?s2^T^(izng(Kt4<9K}BW80Jo)&_Vz zc#y?*Zd;a3_t9`W?(XsR?F!+Aj}Rh2`~x}sc(Df6g_xb2o14wB_V_asA+SfDj(W6LbC6zN; zJ!{oVl6>Rf{zgCYZDR~SVAiBXj>9w2b@esl-8pJ>Wh_mc?-`Gy>f?0i1atB8)Gq5^^UN{I`KeP>?- z=SSeEO8tin=Cgu=MksmAxsEA|l3sz}6;K=r+`%7{^^Wrh&D=u-I2_Y~4e(}cK)ySb zE{}_hIevBC6b@aiK{VHqAbTF?eZDr{@JzFLI_r374Z`qBjr4hySVHdzz0Znx_mub6hP@?yIKp8yu-MV$$E;dP2(9WhdiE|mfG z?9!s)yDPKTfQKRn@psd5%MZ19$|%unX_EOgy08d-9SafUr(CpN(?we6s&GNiS_BY& z&IcgCEBGs#wtXH8T+o?R@r$j}+UXJwL%vBDGD)4SovX6N$986Vj;-%KzD)LaU4t;0S*0KRt(QSW= zj=x2p(^K#mDYTv>n2>g#kpdscYU<6=c$rXGIB%qtPSUdx?^-K%6VU$%*w~b@D!nOt z+EV$oX(4D`;j(q1AQ3GWy~N?$gt4RsJJwoz?$!R=@D1iIF~<9KWJr|wZ~pM(9BElJ zp4Qg|og)!~z%1g+2&8UFDHSdwO#k4T@8=`8F)QcG7@c0iDBH60^)D^#jR;c9D{ZgY z#&ydsYcfcZS^BHrgjLP@7o|MtgOW3x*dW1h(-^)lRzEmXewNi)4&Vhxov9wc>H%0f zVCu=fEnrKv2JG4U&77;Ntv0qQcU072dxzcCL)~BFXips-XEaRS`@63fWEZ~QB@i0- zY-%qUy00E@glNIjy{*ies?=E=Z!?}-4SKb6x0=}s(F-5X2N8e9oZQQ^;Mv2s_RtCXtIep+I+tIm;q8-4|Q6?XzjyfaPaPT*$Zpb(IWLz_&VM5ab)| zMzMtaBmnSqT zqVxN4oOH_gFh|o)y)j~lJ#0*wE}OhRWxQMq{-)36!_`zK=T8leSPUCHMK(Xvf%kHm z1qAa0j3O*9NIx@^Z2R9(CC*MqjwKVwu!h>0hsO zbw5AL2hCyHDP($Gcp$sVvY*&pfc`1#>A)OaZV?7G9I{etX%5i^nZqTN#R=i+1q5@0 zpd=kQva91Ir?7DodrG;J6E{k~ug%x%=&H&aCWyII!_6JdIFNY0PGw3d^UI*_F{zGv z^Mil1tV|$$&|y?VlLF1J!&X^N6v6N}E5*fDReR^zc2D=Ze;BkHq6$Zu`{y{H9z(0m zyc`8!YAGQu?uY`l2rDwf18x5oXPL8%JtKpKSWj0xL=eh8!|$(kradb?8t+C2x zAiQn3$WFl=4)$0i+l41SRjA(P64X%)k?`{V^91d-&OL_O6=sAc?i7QD$If z;ptkUv6L-U;(s>v=GdP{j!B4UJV)V^vkjz(^nQH{ol1{bJ<*qjNJ%W>oYGcUt#(=G zx)6K0FkKHxqy2*>LhOe_9^P2$2A?vFj^_Y)X!uRhoy zyG$O>*L>CAJSc?{(*Bq6ZJ?$cs$VVgi-rJ)QJ8$Y%WJDYv(Gzo)|Vm>0Vl6|qgk84 zArFtHuH33fVUEp$97St7FDUjR%wE+feGrts?sf1S&6tC*OKy8G&OFqGE#VH`T|Y4< zzf`BpEIAL`JGj_2WT7w_rPPi?5>0&l>vAt+)Ny3)%H!dk6kp9yQ@r=Ex=GO!qwWtblTa zw&zz2$m?G+h6m+#om%Y75bvON>t&2xeOcuU6Sz{-ISQNkXz;yoC`n&#Z^YRVupPR( zABy->)W0QOOm|ppi2m*PDP>x~objbV&}2xgaLHwwr+iS8xtILQ6_){Q@*P&N16fFD zjlmTaz!Q|KpHht?@#qJd6HiOr6THlAw03b&LyJd+Ie+(&;wrpNlasj-L>xu+0>i~U_N~DDofr|jr zgw$MUV}W1EGG+-*=?sQ8}JH ztKa&cvjlT54MriLyYW18C!mOZO17oJ4luVw?~u$NJ_+uVk@ZI%J)7=k@F@g7Q0Lf6 zwQfFHp_fDaUeMg~Mk?TtqZi};=u+%`3jFQ6j09fl>zU=J1E=H;Sx!0J-a=`?`s*}w zIrY&GFh>C$hMf4lR+2nX0#?sUCA^VIG<;-ktM+Yh6s{B0QD6UI^Qv5$S=kUMb9j1W zP6}Ta%7F#gGe}6Gj*PA_eJHgh1)T(PVh*`c>|rK~sS}8#-N{R4xqOXzVW8{M@`nnw-Z_7=8 zNqR3&Xb~@Xn?7cs&(a{fNai>B_Y*LXH^apP)^KeJWLqrD05E@w(p{vE9hDVw*?s$mS?G3^JskKwk8Y4$pHFS&c1p=G*VA zugsasg_^9t?p%~nB$}d6c!O~NyFVUArp^v3+6suamh1KC<<%Atg!iF$Y~4M{ssDW~ zB~7mgKTk)nOb0Qqy;?Wjn*8y(_A4I4I@M9<1q#6v)xksqgb~=kdBkALSJ_1;w*Xm> z`CT0aR3R(FV&hD*K|t)&XVuFYo;!K#EgCK#9#PU)FhaciN^TdjN>Nq>_qE=pmfP;6 zrYGAKHTa+uBM9%>tpmdhE%|t7(bmiVQNxn4fI3%x|~>nTK=Qqp;r4AnG)RPwXC z^a;K#D7Eb#v871#mENh0zn{#({mO0c8Y_vYl+0=8db^GPM5XBPocuXV@BY2Io|t{h zKMM&+<-^f_U*;-o0>}Rdx>I&<+J+gUOvK1&2U+wH$a%MHNg7Q-9p%614QH^bPGS{A z5B=83AMuzXZ4UNga{#Y*Joql)7a}Wt2z>y{`ZeryB14zku)1SR(k6j+@e% z<6of{qmQM;m`C*lN#@>?QV5p#S}n*VYJe_rSvk`{tU~>&Ta-__y+kkBN0^&jgDT4B)z;t2BqpEA;_}c-S+5}!Jg6Au8!^eN|Lt?dlrWu%!2PcxMD=xN#7RKX>d_9QjM z=qiP;b5r^woLg~Ss9{OgK=`+Pkj5!(q+92 z`Mi*@AaRvQ;u&2)GrYR)n6DUC=FSOg_uuv=ds9oBPAp*Uizjs7&+Flv6m%zdjou4)j>tPA8n&b==faIR51-poX(fi zaE}CYUk8mXPQ~H1S_=#LAV$e20osp!c$A9|BX{@|S92!PkP8S@#Ww2}X>4zP>&XbZ z&(F{H3$A?N z?0jiJvi-P|4Hgc$6btRr>D2bw2>&=7!DMr}tqwS4huVgb$9e?h{TUSNY|7*@-HY8Bx=kUFGt(+m_Nkr42^~HK)U7Ee)KX z+HiR|x>JPF}y#bud^Q^+$y&Io2W z`*E%+aPRMAxR)KrMPw~fmL1#0K)&UX?OEr>vBCN%8 z=SWsoZdWbwz3ta-EQflRtyY!otGJD|XAztqN0h-}$MFre8^thuy_2PdtiQB5^V(kX zNHLtNyzZ{PU@C2&Z?f?JDmvbr*WK%Ox>>w4wjD)*Lo+UNDatNknH}4+1q8e$S8+k-swk2b#f*M6>yR&;oHy}b^yoSd>fSA? z6*W|qyX|qlmB$BSXY2kob)MLhVO4RS0LG2+zi5*|#%T~L9rPEvP>* z`Z8Ib8m{FyOpAB)LKsiB^zNnP+nXh1*Go6c&}y>NSI~L+3H~hlAh;^6b~V?M{eJu9 z^Vj<%vd158Typ#**I|!B+#AlT$D-!L_$u<;)m%nn=* zf6a%Bws)NabNFJplNKvDj7`_4r4o87zgh2w5N?AOW{cx!aC#Z?tL>43SzEUj`yUb& zyd(kOz>`x@6gM`y9E>LA!|Dvh@PGbRQ#(33a{XXAn!r2SO2+9u1*NR2>N7GF#zA6V zO1oXT?8&E|@~+~c1MMV_y4{3WS>C@lJITuYLc;bl@QR|}7ZdlLdq3`gISPq--JZL; z&V0`qw6@fb@ZweA*!fF$cf>pCbfK-d(QWf?U&q(CjPs+Y@HM1cLuo7xr1H2et<-z~ zQBmN!q@y04pt}K^9m~(Ge36gKL-%;t5*>Sx#62hU%SyslK)3|A@&n7m}DJ?Qcm;9ZFE<@ssqPJ+|P42N7% zB4wEvhor?pydBM}`SjZ@W5Ygr5!eT#pd!s~O=0C$O$WNXTw%=#T8t15My=Q{MysrD z392Yf6Aw{taWx9Vz^bABHpKsmw(AB5kp$4Vfvs=8l3cXz;5T|-cG;44?6BEpH~DPW z_AbV;rM2%g&x_$JjJ-VYTCS|YA8RxaRn#M&YUxW!LHzWWhevkh@aW?%f(CVAOQRYE z5ZI_t*PU1{%)Nu5;s$W(mtT8;Jpj*SZm#`GK*r(}$+vu35ruEbgtz2in%~x;|I0cJ||y^XEcB9q{Wy9)MDyH6AhKNhd}$M#`FYe-w(Ac3{c0hEb?XR1g!CjCVS(Jd zp`@*7h{_cTlBt89dFx?6Vb3(u(X`kc8+o{i3=~~T+*_~h=b!VzoAaHn8yBk*Al~2K z$1;iKynh3(&okXGDKUz~#YNSeYlxU@bVtAzZhw$E>ZoQm6qu||aM@{BvM#2~toLKO zcYGLSIbY)KBG$=qvsLM1malGrJu`)`wjdtXq;31n!DR1G$HyVZoo6aE^%DeXIzRc8 zjk3Mv-|dT!D$vl>zDmcbEy-qBYic%X>enwtFWGU4iN0?Sx%e2~qGy@mJdQ3`=nb{N zhokg-zmzodvNJ%Kx`c8Pb(@q1l#R6oGEgy(7HJh@)qKBRQsS{A5K6&GHSm9vcDX)O zl@jmP>ZV+9bhsYi?U5K@z^2E3-4G85lXv-EBt5szK2Xc|u_)dR7HnOpsPdTL{5b-4 z`nW#Cctf!LFoCp_Z1Z`&;o#A+KQoDy6}>4|1d4-7SSVNT{HX7hZ-Ybe)3Vll%xDka zwTD?1>G(Rsr)P8w&7>fB9IZr1E`Ql+tMU$aCoUm_NxtH6b^8c7Fg1LyI$v>pPC=ul z60gxp?;CSH*QirPIu2WlW97G1)_U2bo_rA?u+NX;_wBMfnEiJ5>ZuTK)^iXH<%SpW zpx0SLE%ojofW>1Mcd< zA0PNjwyX7`EzK1|_5(WE%>{TE&cd2Zm2_`%fr80@1m1mQ!qGD%R%G#s@_-0639aN@ zuYIZ?XsU>Y&Z}oWHR` z%xrA%@W`%s2!VP_KH-dGEGY>A4}ziozECcl*TBKIvr|}D;ypTp>crahD2Y=pLObPf z`R}eRU_Xk=PvsNk{ofp&A%kzH5acs?3Yrhjo>aBb!=H_2o(3|4?>29KZN#(W!Mp0$ z>-F(*L_9M5HL=ks6J3?Z^=?}NkW9D}T5dGF?Kf<)etT`@Q7CXiPFy98@F}t_!us_M5E(L_3OwvQ|DmvrdCZaal34i}|4Obs$`v%K~ z1;zFAh*@vq&cnOZ+EJ|wTfgd1cOm(J_OEsjn45@ZR~ibQAbwpq2B+mTNCVbdPuI4l z=~_@XDs~i?XwWO`=(P0}w77#;xQ^(bjHuEuTAfDH9L{_ntye5`;A|tj!2V|0B_}7# z$;iaUX+jEK4p#OCQVln@k#%Mp0G_;3=6~=LQKUjOe7tOSDrR5M{YFd6jd` zXIx=#1K-?#RnQ9sFN!-xZ$%A{8=0xGa^i_jU-Pwhf^7#c2RR|iMNS#Cp4|6 z-h420$B0qI)SRy{t{P<&#qJ8A#jltwz8fg2E2fk+{U}Q`_Z+us72ZCVZ(Vbh3-fnylu$AAGNq%N7K_G@*lyi6SYE%<&0ElwrSJ}NZ0 zaF;AAFoG1vKl%*HNT^z(OoF-gpx$!ivR_|&Na)x&d?nnj*hOiiPI9FNn&g~)STLQu~8?M}pe+SYST8=qu7rE^_!KPFl0tf7A9uug|l?j!aa=tXm~JHp=6row1XM zF1Z!{pu*rXbKA049foG)dJ4E>6BrFm&y~?L9Y1l$zp-a3x+sMgD^S!GNe*awvZSQM z9ETv`n+&K^tPUH$FAn%mKGsHDL+0QHxfccC_V!!wN$)E~jcU>(sT|Iq>i9IXjTEYK zNiw`dYiHAIvd+kJKfAzEl2oB8&L2*IvZehhayUn$%dhq#Cn_CxXII#{Ps`b2ZmFoQ z($jDFp7PFM;kr=PWS}zxWf|-#L7KEkh(kE4AMw zeGEI(5LY%+#jADmhe?YncGkVb-5bGoH4y(HA9)25OD)_3-zP&y?=S-6w!2Lw~kmQm9B%ky@O{De7j%X=REp%hqT56l?*Mou_A8ys1*R!*ky3 z`$4}482KjlsUNlj7>Dznx?Cq1kECKI8BYk_oZRN1j+hcOBv~rFl9atg)UPm#93RD5 zXjw}E9jVMTDB216d!7JEv2&`1hM9uu2>X|@>}3|9Abb?%`bYtJZ#Lmw6~ zEx$O~5)gWTpNAGLMVcyWiZi?O%O1k%6wbP)Llcf?Y8q}o7q+-rK}j_&L6c~Ra!1M9 z&R{BpSih3xZg-w`>FM_~@|e1sHQ;t5pIdo-zWah0Ct18L;pIN2V6ax$m1rMnbjY;D zx@B(y-_0hchCVSMpFTaS`d$I8Yn`~JxtkWl!9-bby{czf9^yk?F~AuYK7`HVNH3`; zKf6R970vsY>o|9poNLjgY|VVsQ9EXN%XV&ucnT1m1tod!7oX3wJa!s;QhZWy9!>*} zfWH~SeiRU7xgWfx7McPPNEL^0pv}`nx7R2{|{ zK7xnYc3lYLVsKTFhEQl3*`_~{bkZl#DLi{M|K^@Jr-JqhcP?#ov(T;{LE&4Y;Hsl7 z&?`8Hw291FDE|ie*oNr%n_MBczkKB;{`C2aj*X|9-#kbH*n!R#p=nTTi4^V{;icOE z#lV7y`(@}uFICd8WOg zNz>P(n2)SGk^TrZh!_3r!OE5n9Qk%3L5bw|cS-i{dE%=56MVV=fl+T!Y#&=WC1ElC zFF#wz>ONu1T5ti5ol60cpBp@)UQdb5ul0DHwM(=?3FwLmgJ{Lu8qzW4xh}VG-%S0X zm-XyDK)%oTYxVG_D+)CEJ!=hzhx2djD~8G;0TGn9=C_V)Ih5X?(6+Y8HZGRYlGf1Y zV4npdBXIcC=(kIjrfrQI+fuU@;Lgtq7c6Yr>!4S2Oru6H`FH6Q|7JV%=Xh-gs0#w)(Y}-Gide!soJl>K7 zJvFXTI!A`OXp&>V#eWUIEqFnOS`2jUo-7|9yNnq;=p7E^ubA?WCelDh2Q`(?k5B4B zVE`sM@pS5@fi3ib8XTHz;rK4YPg;|4@Ac{0W0NQVv-R|=hnwr7@C(tEtx8Tr?Is1- zPAY+Ur7kasZ4%LKs<^oiW)1~JSG-v_~)Ap zzXSh2C3^mMdPuLcmvb278dCC&@qZfeXqr&v7W?P#i+}U5@l77VCYU2;r-6o~R6X8; zCDcNpr@BEx1S^%GqOwroru-PL=Vt0hi;B7(9uE9}Be27eE66TNqmJ4<2w!zx#|tAT z4E;R34K}Fx%gn<=c=knq@C{R6_@N85sf=qv1iAdC_8eD)?T&VkdVxwgqoG*3-tNa_ z-+ncDeKe64QwU-jxZLg(id+bjQ7xaPUHIk8oUEgce%mab-@x_sj zsbRup<0PmM)S&Hhqx0BgMq3nZ5#8Z|YJ9KiFu^MkQ}wuEeGEVyOAOkrt`&^x-1qWGZ~4ge)_5cR$JH zS(0r!lWK2ih7-(dA22FJ^v=KQa`vNZ1lb^$(HglI{~FgJ)B9HKg6H0FmHF@>h3KQe zeBS#Gil%YPMVfO7S9)EDiw#?G!eoFCxdlXF8U^Ld8gS<{2Sx5h+>7WkbsvvCU) zvTP#*j1+3B@JjcnQPICn(R)6X6&KU`#O0=M?$9+IcVs2H(D-_u^kiSUMTvUi3S>sv z@?}l419!4KFUOenL3h18ir0vE;77#&cedqQd*m^W23A%M9vTmGU9arDOY+(pFXg7R zS92JfAiXb}Fjp~7qMsjifdtw-RJchJX?;_j?~B-JaTh{bR4qj2+i}5VbVJC(4YU>3 zB_?Z6Tu1)zkX>GU$>3es1d?5^Z-e(L9d5eeZ04DLT|y$GngKX^*h>Hpp49IYdgc|{o2 z^?L-z|JtuO2*0)DpPw`ebF`<*ZwEu>(OtjtER-_kQ?viLk1Bz^-5-CF+q- zKHa77+APa{{z%C>e1xxff3E0|dP|{wek143s0pi#+5Eg(yueuXyv6Xk_RpQ2y7Kmg z?|c68KCouP|27*piA>*#3Pw)%F@Zw?9(9>fBS$$FBmu6}J%j_39WbDac9$lo>B*WJ z#+u(uWN7g5>Az7D7(nG&*vR}{)BgnJX2Rx?j$SIwJg_Hdwc#4ejN|XbguC0BPiDgc}))P%615t#U*rWFQ2Sj>lc?!(wcFx3dG z?-XYC*vZ3)q@qz=f@}lAM3K+*k|L2I8c8%yY0cf}-2*H9PMj=TF*$)6aCE(Z*+kA* z_BT?3lhS-;SA4`2v|>k>`ETOBhLp!gg|G!JY0m4!df}H5J5XS}24wx6)EZ*T7cawP z>B4jqfoHWLs7I?BSCF#Ex&L`lxkTzt~ z=u=-3IVtb`Q}TCQlBor;vW`+HCqR?bKwFQ~o*`sd*$Pp7szG6%UUsTcs$G+Y^2>?F zRhI?!k0j|+7Jncu8Y8TS(=Q_pMdnl|?B$CF*$*!!roieZwvOD4$o25efa2<2ITvYT zY|qFo?X79{rXX(OW5a+x&}p-o37Y0l!{pDwT9-)?l}PS913wuLSV`J)AcK~x_>$Jn ziW2!^VTOW>tAxfoJO%*&69iI$OS(=d4}3B)zh}*mb#;Ev?wbmaEZa zxOMFYPMOwxRkZSV_bv5gZn_HA8r`WdgXQ)HW5oUj+VrF)9+kf*LlReAZ`0hAvW2dn zPSK)1iOYbwvcnc+^O{l$v3FF!6(|ygfl0e3op`?!{hSp~I!_%K#TaPkca_@VM~ieu zPU|Q4Ys20bzj>N`N%TVKS1OrDq+WdXIGIjH255eYXMB*Uw1JY%w#=8#!K zAs*pbDXWL^A4#=yY*v?6f1<)9B@0_2K*KT^+KN%o(GCo4Q`Ugf*h*p|v{{H3duf5v z2Huiaqqz>3?iJ%s>?C+w^*s2}>rdR! z`NpaVtij@B$mmRtHs?F4v1NFd!k-6IwwW9`&m*B-eh~EQ@7-}IrcKuB) ztiiXZHwoccon5VveL|Hu>(%yE>!%9l)JWmT#Yp_-*ee07roIWN;k6HHtXVr8N zlz?>l0HONF&sud!^PXKeE4?aT%NrLoxQ=Xc!*V4qHlO)r{i?z+HInvjqXcGhj8{_Q zZkQHl=~By*eB(nbq=*zo+wfd(m^MA>*q@gg>&%>+ng{!*NJu-l=(=#o%mL>gdB=~@ zeCstO9Jb1uQ{6%Nxt8AeiV?xmzq~!nRGIII6FzWDcie{lh8Cb42be&vy@`4e4;Pn`QJbV*O3~9uD*#fo#V8-&Hc8C%?Q>c2*ld|>0@18N*j~5$+4F& zCr>8!T9i-H;_-Y}RFmeGl_=(;>|tjD(?qad1FQ4Egy852MaDYU(fcRN8WYo60{*^m zpn18?iElb55mHoQ5I}kUTLnb)RGW;B=jG- zkW5zHOYd4vg9wCJxQruMS=B<#OBzisw_4^Z|tw(TL*e}>K)?(GV7cri1mHwDAM z$(v}lD%KHe!FX(ATFL?pRWXu}P3EF(i6tHzOLoS!ZVbI&;r&6!&x-@(5Dm#%3Y*51 z)-PJGFMuEEw0u$;EIA_eaHvyaAHzvB;Kx&O_ZNAV_47^nhEjG|OoQ`T7K^|_gT$Fy z3`*161X#AW1#z$s50IBN;*c}J>5l^tpFEJ*=XnvMEpF2~gywE&x`;Wo7@gSt5hvqh zi1O!csvy2rQ5ENavcteD2C>~`6Z6wplb$s4mPzrt@LZ-`xEj5SGz9F&3MTjmUHf$B zR%G6eH+3b zl-HkcPVeG(5(}E`DwivCQS49rsA<%-j7o}SnYlX~w(XtSY=Gq{R^2!Cu1FJJ+3XyO zMwDSD&+mVkZfz?Pdv0q@nhOhd2hVBs4F=K}XC@9jbG(L-_lviA1VIhu6Vkbe$dk_w zb>=h7F~g4@{j%*8{`DfD=p;1JV1t;=%FEGigovW5YySs$ru+vz*>Q)#UJsri=*A1( z%(V<~40EMNY${IT9N`IlxWO--J9Y4h6ZkmeX@jKYkfY>*XEpd78F=psxk!>Om&gmYdk8CR6j$S8aO|)$W zO))r13D1s4TU^4~Mu&;V7{Gor<&;1`fR&=%EZ*lf*+K@wu_s`o3^R7aghwS`V;Ak3 z(Ndfe`xo`n+A1jK0zwAA@+LPh!fl$JrizWSUMDC?RKsI%DS$Sv@sRlM{Ng;Q z&U_zhWt=;d&f-K+TeyB$CYg_-eGOyea(_LYNsZ%gEE(e^U3vgB9{FM_HYQGwT}*cu z61KAobfM=m%k~->wc$Kp{r&_&uDfz0b#WM`rI2MVKqH zTrk&kPcs<+XnMXg80JX+;0|%}0QwMf@ou(@AEaxy#97*bD;)yjroFf zk{Z4jedVbiVyyX`^y^cZ<5_fwYSD)0%Evuj5*c6y)scOQhVk^$c6HA0A|xxSGL>Xe z*11W6WCP9Jb(P%vk^y2xDKur>j>GPELydsXb-$`h=|KsaNhN)LC-63;{f-cB`+&-} zQE!n-<;vmwlMYb!^m9n#{6#N#y+#;v9v(;1=6s32ny%m@?dz_&4<-Cy5*uVEXtMtv zu6Jc-$+!QyvA3ky*k@)j;d?W0l0>Pim1pIy$;R@6%SnV$U&t(cAjjw z*Z&R2#!A+EqrU8kbQ5cCJVcwOp2+cF6&gr~e}XqJlZBrIPC;VRN|pIx>hfl$W+U?J zq#^o7K+;J-mAamU)Ce74cwJ14(_Ofrxe;F2Wk8x6sCZZZ^KY&U#eOf;6#Tha2Ul$dE(0+9b}sh}hX4xV zvTeEE5_5nC*c&NA>UR|(wo*qP6arEo4*iLpF%h$)n%>iXC}$7`5b?^C($EY7=1HfC z@wEmj7GQ4A0NK&o^fY!eW510UI-Bz5AT#FKg4*C_F)+@W~#A1sNex(?p)YG zpJ?(Nr>Lk!5k~ja#s)T8uatR-jKs5;ZYBe`O|A!B%-ZmGc&G|!iDm4`3>&kyra?(@ zSCqQ>S93KbaV?OliJIeGjycW3SRr23@g_RkHZ>2e%&RfxqNW+j-x*CbjK3hp^b1pk zwVnQ%nxN;GJYUmVwWrZ6`R=pfKd`qgt;bR`p>&_qaA5d+u;A(@_ghR(!q02CBkKrh@_7v9Y_9?qTN+?cAQ)Yu2QauR z1m?f?v9wc$?*^@~++ zYE#)i_^L)$I42!K)FgZ~%@d_90)Nm2GB_ef!)vMw^4dth1T;7-ZONFR;tR1`Qo}g)C)Z|Z$!nNjb=E&77l&`vN)teAD5s?u*wd!n`Wu>Mv zKU+y7K+{^#=eMFc1$?HDkFCOXB@#@i=iI2|r&C+W)#V8yunr8-v>IeH4)7PmP02h; zo9{1>yOFc}C=9i%XDuIO468tCXR5JJ&Y9ku&ZEOsAMf`im|1ypD@z&*e>U0& z@R{HO2EZgxFyrEW8jtT1L9wa-)r1EZ9j7V}$>`rHB%(^fN&v6g%NYd0ih>}@4wtXi zG~Yp5fTLxdSc>-lts7V24!0UCEeH1AH@OS2yZLOIGc(hEaTMZgbfIozuT+*sB2S!Uqq9@^OBZ=JT+2N# z92zi;8&YJeDlfUJ3X1j%-;HeXwj+A(uAK`@R%TIF6$p!_JjAn%4V10zr$nyfj(h&u z6$ZH$uj3kmf(rm#tvPSOAi)HbUyaogU`g)>dbN5S93XU*Hq;1*wM zgyNzCuD0q$AFS4?k|$xTGCI?9VBWDud!|8TOohi9@8UIeJou+ylP@V?#@3GBs?}T& zCoCr4zpE^Y{GPkT9T8ZlLlALw;z9n>HYTk^+1)K=F~t5&t>mr+y1ReZerD-m609^F z40qkwsLr&zs%$;EXjc%ftcy-au)Magz(q!AQ)zD6pO+V}WZ@+B*(eX@4Ndi{6n$xI zs;y3k&rGnWJRIJ%T2IEs>&!XAJVRoRv&b3dvC+}6kLAaj zMwumLZCE_>%63pB@^87)hLMw|ytG2p80-+lb093iXKOI+yKxJ(k~qR1YZ3ZozDCncYO}2%;FuU*LsoE`vTxIea(N-)epKssT-8yVi5~}grAYY| zgKfwaq{nct8na5QnGBp#0Por+;V8on(=!X9I>=-=ymaZ272&o6#MC@&_~s`e<=!x9 z5J)E*a&IY-uS8>Oq#>jBb^~bqGQS(OY#EX7gf3(X z=E4ferLw7h9y|XmI)t9|B)dZcwG85}iJ<<2M}GhRWZ?GNqRU{$Op{NFqW+uvM%W?A z%8U;f+^no%$FN8h3HVwxrD{3vUPCaiVy6M{f<;?u0!K?>PpKG12$wSc8)mESLX@e0 z;0OIF^WMp7-hPO#245RJg!g-{4O!VoJFM=m!R^ z4}vI5!!oONeCo2*$?JIA2eew_ohJ2@&@b!=JbzlU*=g#h38v!o?E2k8(r$c4{hRV% z_HpvbzwF{=Tu(TokE!mEt|)nJzD99sC#*OvhE!MfGgdWQa>#OUZK*a`&kymYL`qlS z4}uZOey?S1TVU!VZcq%?Ur?k$OxSV!UT&D>f4lCgrQ@Prz(P8^nTBiT?OIuvZ6-)U zI80IzU7_w%q|3%8OxXVs@E^i7a`FpIFL#E*Dp6~@ZiSo zn?4Byytmt{>W1-}wGRITnl1!0RKt!$Sxh3V7`QP17LwAhU2=^$Ixs?)x?hizkRkkW zuif4W6BnLYg5sxr!3Om7JUCPLd<~BhTuW%rFCuhtV*KYG+y8z8bb>9;wu^YGfp2+d z^R~DZE^qt!(#u+8de8vVEtV_JG)^3EQ4o07ZV#-A67klrAire@rhM; z`Vt*B@vv4kEM*8eZjQ?HQN9Z7)q3GNW5s@i3%eMlkz(dXkmO^=<=fty^cyna#{HA3 z3j9F+K-UxEe|*t+)Q)!Tqd_T*k~4IgY5W=bS3fS-57mZ`tM~g}UPTbfz0c@!{Z~?* zoU|xb@6Tc^*=!EQ$?MB~tFWest7@3u-{X_EbKuQ;YhI_f)sbTgS>M~UqWPe^0YlqC z(fae8FWUrs#ym!Eg#wgM81t^!UX|Fb5InsOK9b9o51AVtO^Ou<-M) z|I0)CrN<9>+lxJ4nHI0&{k{JQaFwjsc0O?UvE-rsPwXHIqNu2dmXOelV1zV~FjyeP zb}WnrT9Cl`DFq9o6Z#Y;OCvGC8W&ro?52sMQQ)l53K57m{VhG!7AENdQeVn>bZtp|oZB<~OtS*j7 z{iGXCMDx#OesOukgx!M^J!zAz)<@f5s8f^yH>annj(F5J%Gb^r)Q!zZ1LGVC7F700 z$=X&9vIB;a9#=gmLT?1e2#-6qrisgpDlJw;CB{`w+92}3=~&#P6S9sGJMt5XMzv95 z$Zt3Y*JaL781~7whQ&K7-KTJ%Q+li5gLiC|74ce+g^r)T{WBZW{v2@)C3DLJ<1+2J zy`juum>E6H8V>We+1&y1%1HEep{p(YzBPi_QRne=DLEBq^iHS;Rl>k`ASrT*6(p@oe@7m3M7n2nliz4W1Qi8_E>QCRNELakC))ck8&G7_1e-3VXi2N%JblA z^sH~SV`ZWD#nA$6Pl2Uq-z1H#;pw1li)T{Ht3b=zFeTQG%G#1GR4a}kFbKvsu@J!x z6h=Rek&D~el6ym=!==UyQK_|^$*qM9`nu9iX9?kt<(U2TAyMeVocoOqL|l2DnGm?X zGjlanHZRUCp!FNMaTXpN;lz7cJFbs3!Eme_zdUQipOuV+=P8s9PVQ(Hw5ksp{iRDI z?34@^jale}`=0zppH_CZp8guh1u;LZ*$V2c)Vg>I1sZzNHBK?{=+?M|9JwvdL4w(w#_VKhjwgwu?YA(Y!*@K~8aH#o}RNkAAAz+(_Z z996yH8Ret_Lz;I-d^Of9V(zERju4Zw_f5cvTka*G ztj6YRe}Ar^t)@gZ8HIZ)!B4%|lW9v=)7{QR7il|k=?z2`QJa2ta(1JO^TsQ{D0G>+ zHe=$XR-CU-UjE5xxH~u8w)6!fIib{I%{}+R%=CrPpJ?&xlRterTd9>(b_mD={ zEhj|OGzd*=A2!A3#Ux`aMb|TXhS|$=HsYsTUK<#-&nK!;e$MM66^;s{Z{r4@#A7{% z@5ic7S4avVYx;Oy+Z~nlt8=GVkrI9TRf(|RR;BI&3l`&-pVSx6{_!s zLsxvtJT({nL^A$~*18NQLp4!E-Ky+SjUhRnE~iKjo8uS+2~V`|4HChPL8r89-@nG6 z;3v`6YjziiuqyZ*o_CsQmZl#=h$yCwne)&%MH#|kRiMF?q*o6hkl4u2Fr)hJ3;rfZ zgBzi^82WFXpNjtU*Rtfsy3T;jaL@+t^Y`LSkQCS!!aOp;ON%`*GSe6|4&iLC=Xd<^ z*XhCNTJ-M**!(buGldD8llxq(SSIcz0WQJC0scsaIrwl0o_42!Zw`)7OhnOd&=@w> zzIIivEYy?5iI6lSQmLHl^QpPe9jldTzmXRDsY@ZDi)_#^qp|rwC#(08+I}5rv}&=L z9FSwc(Scxh0fH-WvyHejT~fn@7U^Yud9M^~c;#Qx^QDHKSpUZ|we3uRx2<(qjEkC* znx3nOv#c~gN{fV)i;+1WN9zaRC>d7#Mg}w5YhFz`(?_KoX1}@3?Nvks0%`_6><@_a zDvCOt9SkV*s6zvCAERGX5LW16Ajh-lASaG)ROw~4p6j|BG)sxVR@@7!N~K?wHw0-_ zRfgm_mO-&Dmj|aTqGozq!1M;ANB0N^mSX2g_*Og&rQ>o>>WJP`4XvHChEO*^?Cd@% zm7}e^P^ca|!+@QWqkUi&j9#avvy$ioT3%@q_*S`#k(*o(w!gs8N z26~^ca9{CPgX{VqKG|qz^TkjI1+#lvow$L=p9rLKM6}-=?sTU!>9JdhbA!u0zxSZ>~Kcu4ZRPr}b8sI#8^qa*X-Pm~yX(l(f3 z6-}#IeiQP-`~Sx71}wi9eu9`82uQw(=%A68nn)jZE>YnWPY!LwXUAe=p)F59kzZ?X z1Xgoq)(jH`PwleF7BnI^@vm?Lf1uNcEXy$#;|i& z-pIzy6pMcLQw!By8L?B9@-`Im79{fESYe0p6m`$dSB0Si8j)NR+ca&yX@tpZ9P7)N z9BnPm0LD(Rgpt5v*lf9myN=#1Ns0&SodcPKV$96d)6%J~-h7eAo>pMQ=?~P(T7#pY z)yH^RbvOzu(=NpuokxkuFZziAs^dHRQ)1~fb!dAhm~5cTk;lOvne!h(NDY627iRj{ z01YwlyUs<>Yb>Vk(@hMLo~X}4 z+M!puVQQEtEoYDrGS>U3$?Od^>{Nszij>wa`Dr%x0qhY?BRs1wy~Qn|5TufeU!HaHz;c>JhZ)3!PmV9A2L(z1ubl{H$XP@GEiT=FY zLaHO{$OoG5?pb!1FX!85he=NsYoKp)(?mf{0$)W7$``Sw(YFdzU+rCARZa0Xhg^s} z+(vKB+e^xnowq}jAu$Bt+a9ab2xJpi}(8RLn!j7z$Obg=bf*Ak@k^} zf01^eAvm*t9|IknGO4_>74@*Hrp~m7hVA68!pRczS9gI1LX*Z&sJzuGSob@$=O_ma zBbl)Z2e?5ve{h+a>@bLhrxgMzMf9p9f)W4iNuD@tZJ{=aysEf^yNa0=pP1D3-FF@t zsSP~ztW|YE#L;Y=2d_3>nQS>)m#uFwlui^yw%?|ryFN*Sfi0oG>Fy$$dgj}RfUBA0 zg`JYy?DT;ie2&wRn20E6)^60eWqy}gS#w`i|Cp={^!@f%CSTssDm#Qx8!>nWGhBok zmhebfuoP)Q4J2EW#3vQP;*mklNaY;VR7A=V(K5wcI}x`OC&}JH{2eoRdIDMac1@Y) zVfXZ8076T9U>)B4`&LyYN$n&i`{%=m^*d;aZ6S{jLG)0U89BzViFa z3tX!yLdP9#RIwP@CgR@7@C#p`08*v+U?@ujD7XdCMpH~py z&)17zI-q>oGdEA&EBnhSe=7fKBeHqD?^%LlKaT%!9hX+Uz6qivfkLJKaNw+>doRi4 z>q-{TTIT$r{yIq_N9wj}LNndtEL80C+~jHDFfVG0rrg>}K{GF69N-OCGtJ-=!R2dS z`Ah|X&@vvh^@KfUn4etsX&BA>wXS!%Ysq`Lc-1NU8Ir3F!}XZOti?|D^+_{&K1!G4 z1@n0rmE#GL{+HEOF+R_fOJ#AZ{^c%aol(lBm%By;47!!RfBD3fzQRt?_VWsUNvL~P z=>N*iM*-JWk;tqZtpcJ%{lOJZ6Moa!`^MYR3@*p@ZENFbUVA&G2+j@FXkyqlkCmtu z&17?ZX~YK$?T|&1tE^k{a_}z%L0c%RcI;AfykbaopuuPJ^g6YHRTY88C5~K`Q0|3H z*)jw8#|L8NrgmUfQV(?Lzh}%x5FE*mII_HQM0W9sa(Il7$g0iv&;_CUsQZU^1w7!` zn3&C5!@%Nu~&k^RP-m)GA5Y+2hzl z%}kDD+$%4%UC3Sdl`lmRxZtY1XSuouB^;T_&<=n!m^>T1T!Z6h^(LJf z9`m;ZLu0s%Y6AwF4TItym7fujg5(RBz@JV)3p+gkkeK@cRzl=(+|9))N(%EDZwmL@ z&kl|0@q$t;75o`|9`-TuYdY3y->Zqq84HoHA7GxFFW$*C_&=)ty)AGmD zP3rGlF2!Fx5mWySo=A&;N1!)k+S8kpnYbc`%UX=;?uYnN8h4{!y6aaMfNG_YijAYQ zy0AGj!$g5oRdJS?h@i|Kr<(5MD_%HTa({qAeJQ;+LU!KKA^853pp1#>cr8t*YzzeA z)UeHU(OSwGDam?yUR-Us0Og{>%!&dvF5YxZl=;!DWsB`$!e1iH*DSvCIB|kb!rxmD z8=>zjY)@_cb1SU7zQUcCdw5h7b*CrGEj;jO+T9YE0W?VxQR0CFq*e_%B2i-W6~@V` z(gtYc#xJEmEgU${xu4jToojaC9@5{*aHBADAU!l7&Zk}_(F4r=uU z4|a``;xn-Yqgsi`GvZyj)C8ikjCgagJ*C@(eE_7Zn^wAWd|BcH`sC%v9ZYPVwFMtP3+LIGCUxlfzM^e#!p=B zVXj7}Lbr5^@q9jQoWX5T)fjBMDQ=H4fj84c+ z_YqE;&BSWtXLl(L57ongj6fgrq*+O=Q=Q@MM#7tl$*}_RV0^) zM5y+hlTt0B3fF?)rwmy}9UuKxLdQik_k9P!-Zj?<6y6FOA2n>ifVlSUzoB+J{PDB! zVTi3&AIq{lm9Afmp5lY^8T*lww86YGQCAaEf6G?YF3&D78l7#D#(UCYW~+5Thj-=i z8(2C~7=|(ZhNYilsp1z4 zBX5v>#(|5~R*7e8O8*Dlf4~0!En7z%(SO5Zs2HfJW%&A(Xh$fYq~U1Y8~3GP8j^f5 zy0O10`R1Bg-?xfm_pbfh1Hsb$c+hws`>5R~4uDVdcOsm|9=y?}?ChSo=CbDsy@J)- zojW;5{A|1&>NOACz5D+cTtBG!Kf`s@!v+gwcYAE$WTAiD@W zZA!n)VPJ~we+(N9b8lO(`CRW5`E)i{Zk$ma>gJTCJxf4#o8SB!fB(;*z50Iz?UmMy z8UHh92VOT+4CA=p)>q3w=&PMUS64yKj5Y=@C{-f6TPo5-@-L9>6M>`YF@FvIv`4RB79x| zxc%?4pYIPtytbZQ$t*#}xRu)O#3CdIJ3%13v_7ZR+c4y)vDWK%iT!**8k)a0bL|e^ zQmER(NQvLNIWXq@5mkL2dp+7+#tE1ZfAZazZ)AJr_|!IP(+UeUhMvWZ8Ucwrdx-d| z;yWfiu=)&4>6jBE6DCHCwY%I7%oiZINCvV7%OiVJqC~PcX+^?f_Z#)J#8rv}Q*tON z#anRFkiPB^L+BI5^uZq1{UOH^OqHiG=3oUquDhKsNu( zP3b#8UU-39Sz&WZbf4}#0B)?8x{s5VdvW42&V>|^wTyxFRdXN}=X$ic;{)+Tl6hww zJ8augcJ^Zj?Gota{X^Ktid4wy99!Xo2O?e%b|YRVfP?4)dshGO^LJx!tVnEi$b;neC6@N$LYW(XC)yrvpU2LyW26jjolQ;6f? zQAIeID#gcToRp2_DwtCbN-=w*4XU>qcoMoK!|K?odr{)_npaL3%@F^z5ccX$l_HOY z<-M2`M7=YbH|o0*Ry5zeUWtN!oiRT@;mkEfw1_LKD$I`PRy2!j%8!X}YORY7D!bfJ z?GFH%bFsuGKfp|Q+Xgp$@A_*}w|Y@Re~K23_J|MH$K%-MY6M|wk*KKB+p#Gg8&$`G zX84DM^v>c~C*;o-v&S^Y>VTNMI%(QZqM;!0-^S9ZQd&AH@P9U@Xf1Po8q8;%8ml-t zkQqTRGNtDbO2$M-8R2aZL6(L1rzdH8r!q0N|1eu@KKosho|cJ zoW*L0ikEmZwS#v3VavrX8pC!`M)K0DII+6aF|U{nGNL-1Ssy39y4pXVD_rU6(6%(;j+t_sU-x z5QDBild0}^cD$jWL%=JOfsv{r1s=CHw!mZnMhjh*3b2F(rJ$`2?lfxhLd~UC5}SG# zLO*#ZtJyprl8*DfE@ZYl+P=Zen{jgIBmat!tXdzTOv25JB`r|@C8_c4Ay-64H^l_J zLYj4|X$^V1# zHb5KakXZ2SxV-N$c?ygv+8>lK1O#uOX#5b&GEP4x&*{SyJ+Ab z|3X{03FCUufZk?MraF=Sgs zAtEpth@}xMN26$QGNb3!ec1Lil3HmZz8;ykG?Y7@FZp3?;>1X9IlPWzBUVn zDv)(_rP7}U4+^BDr!{ou4`ynAlbB=x|b+^Nl}FZ z@JXzg-P*Q>sVyb}F(m6_qnDoJzV~sjWM7Fz)B;)M`MRE3k(T^q#ocMWdIe;P+5z?a zY`^g4PXdK)@iO{!U}MtoQ|Cb3Lj|@j@3GSZJnk!oFakA2&~@&#pd(7zwi;Gorc>wG zd}so$#oXN-i;I&8O73+`+~aC*_y7RN&V0nvPZ1S*d3oy0wCG=xTeoeW^#iZBNqQOu z-T8*zSjB;t`j;o#Ya=$}5q9uJt?iu3fKUj!)1juzS$XO`aq-Y%-XucH{oP-j6nRjt z!ptND8+vbqdX;CVvJZ}c>#*FxK{@M9JysJ{idIPZj}2{j4L2d@+P0zSo0~X*jDEf$ zk7@!9-)=+ZoTf`55g2$szMMEeVxH+yz{$bE!2pC73CMYF%g-6&PUph8Mx`aT7>Vir z@fPmB%ekIsg}x~mr&5f_L3a%(IYWP5ZNrE)-!rkhx`HZkZpQW}QQ6Syi$Vap3SRw2))@OEp1c33z!?lS(-*uAY-f0uy#j0%oc4PuP z!b?wye|Q>s(+lqoWkHBk{e2>ftOENjl0yf?zLIqWOp$zHi4Kz{RpK_3&|o z>sJ=14B+>5pIv&YtO$x%W|gN1i~}+DIYZQblz`Rutk} ze&=or17~nzRkMA&v&r>oPGr5>VK3Ks%7xrUlS(gD3D4Yf&u+q-@-ht$xuM!{h;4`a z``#+U=aV{Ta8TyQ;&*H8vvIAK1Ii%nvn3)I@^G*MY#Z)N=ruU0*gsFNgp^ja7k9sh z`5XFPYWy|h=96W&)w*=7pW1RBxv$T_zNFktnqR3!MCOKxJ`ko3fL-Bp-iwf5uXe+y zq+{GmwA_0jfP3zG`@yXb_+Oft9?}NF>+vt=~hTp!DL04uuWR+5KqARvhmAJpDx`ImIM7T;Vo}VM(T(R zfg>j~429Vm71DZC{E?a3Fh0Ny2uvf4TUSQcN6}&AFAA_R7X9rYk)D>_irvqn9kw-D z6Q(%8$U;g|obSJ@60F-!puQ!}%A&nVZI8LBYG3_FQ<#r!*8IqGlJtf|vZtexfDHTS zOh#CA0$->A+<8l$ePUv;1?OcB8)$|JyT+sAIXB$;m+oPv#L^0w3Mknl$6`pP*zsJ2 z2032q8R{s3TCs+gAgN#2bwJBu94D=VS9gEz)hxX3+WGjb7$7Y|koRc%IQVyRac)Lu z$1&2dT^yn=D8%8%Ay#h!8$pk#l8+8&B$DrkXJ)qOTzdKC*FDVwxq0X1zsFyeP=Yp+@B&$ST7xOWknc?Uksecvi**GAU9BMTbNmU9LGB$S?&kK*1Y|&| zS2)Jkv7*l(&}Xod`0E+%JuKu%tjIz6IXVSd{NiwSGF9Y{_je;auJ#FS2sgE*yYzAP z-zjpgGouY~8)G}QIDZ|E-^z=$$Q8M?DpcX3FfUr6%Ec}J-@(SNS z1a0T5Cp4855f+h7=x(Rvt7Eu(u(P%)g^3Ap?~#h8I>9TCx|_c0vRUy-Jk&D*YYVuE zTuBFwrGK!0B9Ya5J!ZamsJo{HNkMwnF6_3LBYQF2=4&CXXZD%4ahRjT-eR3@S{DvmZ;|6Q5D+WG0j!d$t@#h7U zq?B##Us29p0Unu(i}dh`=Z5!9>&8t)S}%x9PG${{q(c+m4VoUJRlBr2Zdbzc*C=NE z4ht&YA5fnw?&diN)lSPA#_)3H)Sph9cd)cRj=->cHGaKW@s^b6R&v9T6cWOv?Ca@z z-ubg`X6?c!g#k#f?rdduq4YdQ+owzLIg2`Ex4zRd$ooXd+{%^pntTjQDVAe?O8`aE z{FTREkNH&wLdvWErS47WX#$mz#p!krtgQiiEKAwy=e{Tyrj}sWaQ~aW+r#wav1Fl`zZo53^oI7w*x4!J?p=W6dYj9->G9kP z)(LuMaGh0H;T!DlpU&P_gdb&>J;(lBxip35^c9TXu*M@A7+Lq4UztU;Nc@xh@;!qE zIE9}saM&7Pw+4wq;NRYV_2V&uA_S=7ZQwx~+UIpWyI#1)+Ug0`xY%&xhg5{am!F^6 zvoDrIM$bR{rZ9L3&K>VUa*HI@5=MhAxV|gsJ;nmjBRe`ROKojC86!C@ElGVb z4^ekMUqm$CQe2CT%NHKfsFJs&CD&bND%q@)T{ zZpNBgs}8q8m9etWhD4uIbs+S$E7D#q`>RfvSKG^x5TNfBvbfmo9aJ|=ujAF5<81II z5WGm_N!jP#wd#q!VmK)f0l*&od(|LQp?f#m{Y1dssjK|(Y}~(<_6d8Rf zIb*>l64&a~!SZYpJ=yJR?W=`2IXy_9{ssM;;bVLF*?CzE=GZ?cZ_0S(vI`rwtzJ>H zdtE2fKIv#q6_2yqi=!ym?sVg8Qgbh4{eiA+kEKo7!M5!=M9v4(+BN~ae;RSmz9*h% zs+G6SB=Y56(^dO7Pi)uYV;WyO@0(r=K-Rqy zw+ZqJ4=>yFoCaW?2M$V5K|`7A;D9xe=|iQz?UeS3g@`eZU=In8Iil{XeP5Zh24SRZ zODA#>1>Df_G@*+iS5$h$W%GJlX?Er(XTBL_m`z@bmFzPmfGK2zl%3?MKlA$;<)(DnLS zlnE=0L$hjHac=q)KQF3?rFDI2OUFT$(x2yrWb-@CJgSIApn4BbwtsBN?>|IvNg9AE z-r?;JLy2~pSYDLoi4t#<@Wh^JmwvFnz{W$iuOkok41VKYmo$7&(ED`KJ#%17-oKI? z>;!y6&LKv++ELEvOpy{o+wl=r`hmlzbcU1WTAZf=tT8(G&>bq3Ne^kGKe!3&xxC+|PT2SY1^DG_|(A`s*6CaLrCo<7VJG*dv2yh;YMqmJT@O z7G(VXfyOrs8)5-#W|O?gZz(*aLhKvx z5*$BXUy;YfG^VRc!ql^fbZMTx@@8#iFUyUt8J7MFn6wCk_@}F|bNuKvGJ@xZ)L5Zj zJ!_5P=jf)hri@6XTt4C;eaQK8rDoJZqGydMoon^Pv>`lBD`chmIKVP=5^;vo2urTrO17KrIA*bKby6J1^e2QC`YLzB2 z-U8lgvZ>$>yAxIxG#R{M>HDX*e34n8l`xC{X3O`rhZQEOHtm_a{Hf?t*XdVNU;k4A z<-UDjo)xb@Kd%wp6|T`tP{wPw*jBsW6!m^JJWrF!UR{QP$hO=N<7?x9kcEkY0zZg^ zC#feaVv@)d0WVOlp{W_)pDS7**h*mBsMOp?$X;ISE0Qm7Sa)3>sP~hYf-7F6@-Ic% zl&hx{dX&V)j)dipAE8jSe?Xc}1(1#!sN9WkSFNoWB#{uKaS8=DZDY_eDfz5bX>4atTgO;e=}qXs}nx5~D36oth{ zzdRT+-$#Ne6Towf+ABJPfi5)cQ^@e_Ivd8j82cxDL-ekPK;nDDy1K%~Cd5cel+KI_ z?pO#7tY~Um6QE{eT7bAcOkQ4G>g$4U0qGOO0XJNMDEEW&Hg&&+x!IwSE3m8SIC{mn zQ(P67N3qArouFna|I;KyVVt7c4?1m+Nt=+J2uojo#%<@^#CroKr>x5+c}kUk+3 zDkfI_{g`7o$heR-kayHPLfjv1lsxTb$6uVm9I{PAD?Ud!|7byo9bPV0A|_P4*8@AZ zT8#*Wkgr}mIYUf(tisB&3OFujTS;#kBV#x}7p~ws7K}H(#|#I*C&-cxtjM4Ki7ba& zek^fhC06=@%awHDwEbDE8ekC&f8 z2KekGq;AAByB>Ip;F!-g zsi{VeYaGAg1*aEW-(PR^j8_Ef^R?qrZ||2@yl`-6f4o!{v%>8c8SA+!%5`{xmGSR~ z0(h`WBjK&FtdFQ$tR_w{CEABf-E>J(xK};THHAz8Pr4Y8d88#Ip91!$)EV9$E+ai? zu7dEC$*I(KT#w*vMrYt~x4Yyb1Tdsr_k8-je_prBriB)!#Kd9JV$eMiy|0X3+nEtPjF$3vD-88xH0X}p%z4u03!kyrrThTIXceRzc5oya`kO!Q& z_V47IHfEr!Fi4g*x%E2^1q(8Ni!>{H-11L8lk=4|>DL=%BC^cT;oyRIg>sPeJkfuA z96Eo|*fd#JR|ibppE)QR1Nl)Zc<@{Ku*Rrusq8^(Uy{{dWi698-lAqGG3cnJKS`*^ z7bqusc?f>?5 zTz2tMB=V&fVouUEQ!R8E5hI#;a?zBK3hZ42!Hr_Z4{M;HL^(+D>0`$A!PTRFD$T*s zqQJS5l9GN0r}hq@xQj*G!Vy5;pd{26JDA_#;t|6Fls; z7RaWU`&p9x0PBZJ|9CPIeQO2*~~Y(e6Gmu+~-lM$exXGC4!!<{q)=Ecg!-I^0sPFI9QQnRKoj`>DUp6$xh zW|eszr?>PUJ1r^yeQba2>jpNac=47_+Gl}fWC;lgPIp4toU|%U<$v@!f=8!pbrgwD zlHTmCBe3D;RKg6x0XchwT!IoI8gk#ndLc0wxOsAqK|@1MR}eCxJUOSxZk>%Q1rw z6JxS0qBFn`Q=(-~y&NHd?cR?Q!LcfF7Frsbx)^7ac}rJp;&M8l<+>7^2J%#S{JR0} z>3e2?5J_At1F#i#__gwwg_i*m!;v&9k+f_8o9)6A6YkiXoUYXB$JAq@&o1lk{lrN& zzO9`6Oji8Tl`<=KPG8ZwqG?dVHAgWc?c@zG<0V6|R9!2k1DAI}{H4X==Q*TNs#q>k zOTD@fC`{#NtHP-I$yyQbC2JXD_wPD2Tp(5`95{q z|CVGeMfYU2sxx{PyY8;R%!y%Kx6Nxx)q9)kfke|QvB}ix=m6aG=15Ti2h+y&y(2B? zrOZ4@ASj-bF@U;dCrFlams9Sp?3JMty82Hqg4@39f%EomfK3TSFKeAs{I&JzrzYK>A<5x?KyMcG6pe>RDn0HM4LdRqR!T-jCT;=D z=D{~{P&9AX=2A*>NPEw!8~vj#+3^Pl%KzBgwNY)yN3kKm0Xd07AJ?2j z&LC?$*G5FKQHif#&N7-uc_{8au1$IyhIsdfj&g5rb==uy{xUAu=_~N>>1^*S8)ljl z&7X^jwd+}0lixwlwdsfpF39oAj8Mvj9iJLP3A*a-y2us>56kH& z-llQL`Jpw6UgzPjzXQEkm~Z5y``^$0lC4kYFuj$}cV@2Z)w9Rp;yJD#$*%10;YzGM zNriW7PR?j8GW=;fcG_$r$QF_nqO*l74}Bc7!ip7VXJ(t*IUq!g{LyA>CIcTQ#yDze z|6t%tyU5C3unnD@WknU@IN-omu=K$iuu4x>;HAOLhNKI~(vlRf2shk5^Wh3vgXmtt zRSO6{tGl=69SU7|3tCj!o{R(bbivlnOkDS(6QtpY4T;Q^0r4?#?8XD8TTe8o_B ze;h5t8azx35>{z?UL(x%UY@r5pLtU=6H8Ck$1T${Ywb=AwKFVW|K$q7xlaH;2AKaW z^y)6m>+<<$Gq*+)59YB^nBYbeXq{RoS+U&JHW5k4i=o%xg%N}s?B(&*XcRnyt2l() z7VJ|I;rWPkk>D|Nwyn5Yl*_n5q0Df#rOpzm`=51ysAw6i z=o?S%^OM@V$IGzqoBhHJw9I9(oIkbFb}&&7&-S!dhA05NIQ2{}XZj{k1F8Wq?QEkf zQ!GqOV{3$LMSPg5=8>+t&~KT5t`a&L#!{V?U2*(c)E%H9TWCV4gX(bLRW_cV$zvHnGxjLpEn5MFb{wjI*Wb^kIt;l{XGNTj`z3r zvrRBX{w6Wox6l)_{qa{;9-ETJQc*czVK#JUF07RV+yh)xGys4EcFV1lwRb>(jfHc5 zg25e>5+i+QB~9yYvOq_^a#Th4BW+u8B)LxMRniq8DL0JsTj!e2C0 zpk0IxvN44IOA@a+*Y1~#OLt9bsu(o1Zmwf}0fhSkg0uv5cta!Y-d;Zbg=cW#9HXd^ z>DNr;JB7SYQoF32S}rngJE&3gLp^d-k>-icN zHPft0i>s^yE)RJ8wQbK3=cJ8}9EY*L26Q*Axl3t%v8`B*sgw#H+tTR~0XOT?{*E9d zP8~_6SKq$Bpw|Zhfnw_Q+7yyY`FVHo=*TpjCRJ&p<3l`*xpPl<#a=`WHBJjQNUD{C zg~8rc8c@cZ{2MM)7wXpckJUsXO0YH;0G{BudBM9|8~yMCA#5DTrRf1B8Up<+5^yG$ zECw$nE^haL0CuY~WXD?fl&9#Gr4@k96gS02&+k2sqhlWBDK%qqc7i#btMN97Mt+x} zVAVHDk1GHu>C{E=cl$h`zha8*Eu?2ZW6{^2{cb8xo4I zeA5ZZXm@ckszJtBiZ0_|Pswcw{XU)fSHYtgJC<2#2xjWaLguFa7EW4%npzrJqRQAb zSWTl1l7f;a76cnmpC;b&j+gDw7 zioiMA?OwE-t9RYds+%nBJe4JcSUO+s1U53j)}pI5>~5@Mf5TpGI-tX#G);zzw9Yfa zk^otiTUq%hAG7pBQf62a+zxDI{Rh_-$@D_IJ|6`*GBaNwBMeZ(xE3b>_so4s=xX>_ z`mlAu=wLdB?=IrV1eLI2e>5u+ZTUPL)wiZekR$EINNH$Q$ENZoiLH)4;+2&4%&u#Q zK8_Au0Q@2G=6Ty85@BED9p9-6E&@ykbvBL{`l0z7nYpREw3V>YD2hGiJ^)d~-ULMBHe(PA}7E zLAyG&JP>HN)kJDlaltDjAx19)Y+OZ3$?Rgz6^SA`#OZ$ggF0lX|Bjnw(+4;8;n@tP ziRFeGn)=3;*ls+y<&^05^Lgj{u1!Grw{9|$qn3uG(#fk|{kHT%f}8v8pZQam6svmw zi|^Jre^BHXC@uS`u=OkG{!weiwGF-+UB=w9SkysV+d*&f?~*3p^d-`dPI!5rx1py1 z`T?|r9Wq?ppLQvoX5%brM&pD?+T9b(4_-!@u%Nz%mV~XxnXP}(V`q5w$zMT4?y1Qi znO_kgXoT6QM&iikZ`8htc5Q*oluT@%wNYb!G>Mm$>$y6> z0==+dm)gJQ6&i*qo_*zX8`KfCKrEX4)MONl?mR#V{8i8>@~49^LFE8QMC5_iA9*2c_^MBcn4tiv@k5iV?@e0G=L>w9~&)lLBaEmjydPH zY>~v3Mj)w{_#M@|)zXC-fwL#Y=*?dowYIVa{zH%OwBa;(oiV#O0b`bs|K}AqnNF1n zJDGd;b7Hy-s6NlwM)Xmw(`8b^;&Vw8O%y{oI$~#o^2zp5rDJ1INzW01wVQW^*o9pJ z7eZAceKT$5ckSfhfq^OsHN`iRCIR01B`+-AH}z}bWhE`GwXk@Y!xrDmLUFuZhs`w2 zrKt`NGbbW87wre0?e{Bdr^!Iy%{APj-h*>->m3*K%&u?I{YDuL3%A8ZE1dt}^izOr z_ZG}UR?NXj+4QN(VWi5m`NK}I7KfCyFGNi4yiu7OW&Z~4(XE-T}Hwk5bNqB^Ll5FWi+Bu(}P}Bdt{~gZ#x)9`{A}wL& z4*vox(#7?`zsG0p<#nm&En%l)=$o7Pndxunqj>g+N7fOA7&i|^V_uQP$lO1GS<_wr zcRF`!mMqJ zrV;VEgj4*O*mp*ps5LTrR!(%iXH;Rg;el`vUPHkdWG834zV&W%PvA?P6^$rZn7S@2 zD+u>fYg>X5MG-(JvORdPqV+Bsc&Bg&0eNGfvHTT`TMY1Ibo($p9hvF|Yvx^JGvV8X zH*Peeb;Zi~V7OU%5Y6dRAA9H0#i)Rr+tkqvF3e2;9DNP#Y_L43+2mb#1!AM|+wig- zb^@*dV;?DxFEMv7OAUAuS<^!M?;ys_^=3F%3a?75-eq_7^e2D16RKudvGWRX2(f_j zoGV*Z`H{lo{=VIMcm|N01#7r5ok+=^J>`|!g zvc}E9-n*EC#u}aFF@4_2yQ0*!V3~*(U%lw#LoeaSB)uGEbWS;iJ< zSx16{q$}kN|5=eCdGAnx8`Dq-+=GON&bVRiPLSjETaR01mk9vj&G>D{{LjPM$_u1l zr&gS0Y5xR`nZl-}G4zaq0&g#j-p4a0ruwssb*AQ!rSFi}kvI{8Pj3DUOq3)o%1Xb4 z51Nz2le+~G;<%;AF_n6gXnEQmYt0>rEYidhLkH&bj@Y+^LG5_N3nvS3?#Q*bb5_Cz zKmX#PVl2QXo(htI*1<9G+T2YDR#4uOYm@7%*z-m@bK7eNsZmleK-QA> zVyt;w{w5zk%Q$3?`WapwVWB4|l)XfO$--TAcv4a7yq>oPtXhT5X|q21?Zeg8@BUf7 zmUbawBP%FKhmvws@72ndkFw{p`s3`J$S zwmG+smddovc$58;zK|$0j6f5teSNOTERkZ~U$K?T#VW!5jq37ZAB4l^WPjkuF>27E z!XZ)7VpMv`h@H}X5IP>ppSeF(&7Ckg^zp<)GlU6x^AtE{<<_C#+vwej$0vsG7TJ8h>#d^=g>_D{cUCFLJH6Wok?!hhuR);`)zz|6(>i@KjxkQ5x@Sl{xx0= zN4zz+EB(t#oBz!*lqfDTP8n7}LLpTk`ZpmDCCYJ}5>RX$Fz3Jp+yeZOJ9}FuFazYU zZf<^$p};xM#V1~wP4%OyD|)g#aSHf{g~JFjKi@PnBYgs`s| zn-`N1c_o#_Azye*{geW{Ix)&4 zV8;Q;bLOTUmXWd9ZtdV|p)ePGp-Q*)tC)_ehSM|1#ZyqJ(za!QTn-BJjO%W*A9rA& ztFTsFL*U11oo)(y`NpLF^zMaELFWeBhg`OQrl5`X^a>7c7?YYf~{r#q5V z&`&g^PaF%i`&JXO|1%|8E{6BzOzd~TCS#L%A0#wPSMRN>5cTiJI>Lk9|LJky`|Ps1 zHacd{biK4 zjr#u%7HP48i;DQnXN>;$%D8MlI~x-<3e@g7E9md5&F$VXq;Sxkz)9pg(U7o0&VD3G z5&qR3Dv_1tWAO4-JQO~B14j|jV52pzpP_jFabpMnw;Akc7sfrOlAm8`W}CGbXgaRx6wih0zUn>AX0c9=5tw`9=otvJX?fs4!qQX z-Kd>+xLQ$>8v)xN>Id@s$1q3jiZ(Mq{_7OCMC2%B&7TqyDFjqGC<{+(WsGi!~e(ZAzZ2a7|;@k4X(zpAG%O za*LxKjP$6f;H6QxkQ6hj_Shf_%WR|1zWf+U3gT66MTP1HEk-I!IfZ#R@qj(O`2bFL zY0dBo-}E360XbU&@Io3@7}SG}DeNZy|3Gc5yEr&_my)@~Db_~;o=-c|Ub(a2m?Hnd^Yo3w4!Iho-=3F{UbKR0_zdzk~2~R6ESoSFxJFR1s z&@2zF?bE8!M%M!Mx`OSeDAnqb?V#`bsx+h|#a3FYp2|MsDy?LsU(9Pf&PPGcTxn_v z=bhEkK6Q8{4`k;WqUCX$OM!-Nqxqj8qE<~QD^(_;eOLWnvV57+TuQS`MtN7)XWeE` z&~jZM6I>QUv&v?3MZ~tV-09s(5cSkoqwlUA;9h;Z@@p)dR9P4ovqkDOsL4!;&|E^H z^MW6uL~X9J-3OgVsRFRs`_x_uSRh1+B=J{;BW`KNlLzi!b?18=7t;NzPDJzi<(oEu zT^_?>i>ioWwwE>Ua?Gy!-v<(Um#UB>;%KxqCJ4eTMv#qQB|TX{3K`srm30Cr$bWY) zlw`LnVs~FJ3kr56&6n59Vy{3xnL_M7NS*%&Fe%R^i=RK2VMWR6&*Ppp^ox6B?(Y-k z$&us1vTosP!E9ril~pSZ+wv9$K$p}{wHETrKbAWgXc6y3ioB{aPg`isVeZ_|;*kBU zIRZS==SH@$c^!@hwv$p>{-tc|V-SHp2w$ezuM0%&`F|yJ^rB$0W#nqB>9()C#{zIi zF5<8C;kI#;^3ymf0mb?-P@hix{w!c z=byAKwRbD92QfWzi2%p8mLu1geOFOEgw`_h=Yas5di|3)sU?@GgRKiAX@@4Lkn-%dW$9l!T@j@H$7oJ2Jt4Nox| zE1Dz)L(>2qdoD5}AU7<+&yP?nb<6X*w)WxYvy0Wg=o#*wXZpe~Vz`#QVE4n9_g+7z ztmEQp;@UksD{Hc^2Xqs~y4)&fV_7gqEz(3DR014&TlKq_PxpC)+QYwk%fIidyU+jY z%m0s{dRb<3_tZ!W>mRo7P?*@5S0U1Jwf1rB)iKPqabBj}a0wHc=BSyYCm9di+6PqF z7;&Wy?NsG=Zxx!i4n00(R^#QdMJJ}{UHnjRNo`HjSQ;X!v4zw4cQ(AJ3mXkKPvK#B z*!>(CUllaeOj!w2SJ}**?7y>lpl zB=>^^C{KLTZ#=U1<#P0kBeU(}l&&9*qSDlN^Y{FdQXn$_s<=1meNQ_cLULB*TEAgH z1J@i&VQnhq(`os-LhyDO!|)Q%oA}oQmqN}FUP2`Axp(0(%yjMrt%s3+nTp{EL3@-G zJeww_8+g!PZEIi#?2~Z#aYK$mX5Rd_B`vHf@)DG+rkzc88$&%#{#1Nhf#ahrd55{# zL7U9%JHN^!`RJD`K=l~IlAArJ&LDNwv-G0Ht)I)&Z!6TtNmHeVSsh}J{g{a0hIG@o zgtEZ6gqYg;>XYbTUf5VLrq9Am4>bqUt}nu<=N2@T+0f0m{>r7kp-Q@AAf%9rQ+MadUSgyjJ zA|^KSxG^KJzaIt;CvP?;25!f`&x8l0!GD3%V7_}(Kx4tuPv;g~bN|IIZfmJ*yi|nd zlF@Q-!v~Y}1T3j53(|ngBD)?bb5kY75VBrTuk@_~L&<-g1B{)cAKqk_=i#PGF6jHz zvvyMCxJ6J$s-(NX*DNX5Z{hxKZYyXl%V}w;W+CsRCJE8-v7iomxQpfupm{L4yN~3h`g$4mhI5!DDbsPQ`XedLOM8BT;}9lRIRQkKRrdB6-~%WF4Ni4 z4_wFxh6U~RiAq~Zs=lp@*eeGF6b4<)wZEn0U6pfM0J?weB2uJZkmVMWH+Z7(y89ao zzE)kN0yRurXj?ADt#XwkeDUd4ls945WP+_JJ4jwH$|&4N%2w<|b^7W8@MmO5eAdGj z1M&9rA6SjpKul`?&BBRbx~_iD=L@ZDw^f^qpMAJ}@)E z^35}2Jj3&7d!XSeB?h{ja?u{|m%Hm}e5lfJE4>3=CZ}Ar!)v)El4+I*Jb+1YzQ`la z!#Qa|ZK2T9#8b-3>*UU`srbFE+VrmCSRu$*19w|#zwiv6iu3osvn zaNWo>0mo4OD zSW7oRQel?GIEPn|nPOXc&jac|V7To8M__8j%mw>uC2ih9)&N(lA+_Qbc?u0aw2fkveT{3JXt z&6=$tyOa9V-iF8TvCUh>B2|iJ+fjBg(Hn#_gZXmH`Q71s*bjQ67kuaM{Z}a;sWI9$vSu*ewqF5m;3gf87EjWu5WeZeoM#V9scGu<^3rOc3sPg~ z-+jf|lZAza17aRwpyW*f1G(UbSg=*A7CH**)!zo$%^CHb&1>gpiVSnk%ue$2=8Q$J4fJ=V+%UiqlN2j*RNULTscnTa$wsc9t_^ zkM)gJM%pHa(x%?=*~x!H{^?pVXmBnJcQATql-m;4xMFs!buRbf6XbBu_5Um{?iyzP zy55FELCv(>2}#O4CH(+rh3A__??fGGA#}P4$tMKGfVH0lQSe}b$%B#L;9+6n;9z_2 zU)X3qu6xhD8ZYOXg-OWvR{Yc3TeHotEn2+Y)w1rCx&@i!D@)9zO$6){JXBN@^Ya*& zhYf_|#^JmVg3y<5jWa#tS9iRbDnG=#oqgEl|V9m8QSeb-8I1MnC>fKp(WWneq z7PznO>Zu8*Gq}1lkn7$L@HbVY&dRxR?8#G+UB8N8XEU?Xs@tr$wk(Irs)fOg@tobA zv)HF@6=BTeUb*6;Z1Kb14{U>Rk@c`m_Fa9a3amw1Fzg@G!E_jSaNS1aXlzT15aE!F zbBv{^_y%od(&Cg~zhYu|)XiR*=#as`35X0Ursx@#lvS7K*vZ+#1FurIsS0YNRAm$o zLTvslzK{E;mz3T6EmUgF+H~uIo5B;8ZdK;1Dtw0R597mXWRA8L#dEepy0VC>AMBh& z>#$KNdhPIu(ol`WT_A8`$Ht99;L{LYufcq`I+ROHjkmy!U(!IwR$$qVJ%rQXV^YT| zE&YX@BquA;l*%eQ0bJJF!PQKg45#eGSyD^f-QJ3i+M10%#8UKi4Ia|NrB8BCsbrI@ zj^2tel6mO~XEZy&RZT<2jEeFvRTmjzVBsB_mB%M3TkVeKq7h`&W9YkUn~CFU2gcoy zlPN|AeK>%d`f}Me&VF?7F#UCDbM?curFVrYl=vZse?aT5%FLGkjAarm&kcJZ0}t%f zlAAg{=4QTP;p1jjz4Gg?;+lmz)!C)4prJmD$f#k6U($s{sfEz!DdnH5yn8mKyJsNrqqgaj}~LQSP~k42-gu}jT)zK>kN zd(?MUp9WO|aueVxI$T|@_`-A5Ur`s`j$e~^gg7(us2+o;`vd#T)z{XH3iB3)@c)L; zRB5l0$YQ^Tv?Ikrw0BLRU6{?U4Ba`nJeUZ%HjHO|CRomSe>B+R^LbYHs2a5w;QGLg zozk*SkG2QMnb6t*M==eyg(UAhiq{jY(6g zje^FH;pI#6$O^;OtG`w8{V_FlIbJH*(Mr)0w+$A&@58*bQIzPynmTIsHk4MuYb8C< zGmdnfTg|S$fl!71d;xUl+o_^t3h&ySGE?JI37#3cZ|n`qK3dt5>r4<7Thuad^0p#O zKh&}4_YB)ti(Fh1JyP(rr_h$ZP2D`wne&T=+e=DYJBjAOwU_?kSWocM2FC|n9qX6R zOI#BAyR@TLc7PTCD&lNIF^vZ{QAP`>3sK_a%s4@EBEW1i0zWni z?9vrc?=(Ep`Zm_C7geHvPn4fq?~B~s4LNgsEX$U6{LGVA!Ft7|rgEg?V$d?Y%9=~U zMo_oAt_@o#dK*mH8&Gaf_5OVDD`>-3=Dwh3&T~na<#4Pie6td9qUSJy)l4fOFvb4M zTJ)SB;&dHG*chxY34In*%Mb0?xt_>q{oKSR9ujVG+f}{xN0N~ecsPTad%uFw+d#su zM@7HX)84craq^@1Xt!FU5xW4*)DFx8iZqKx%XExFlo6e&hJKT?IO>bMm}iqQA4qlL zUq83JoyU3`?Cuc?CtFD-P3Eff1Y2=OVuL1K2SZfMzH#8I>oMgV%4N_MXrH?LcF+?! zzi`%5b#`!{x=yf5_6SHxJht}qi}Yu7y38*pPJ-Eg?WL|MIA$=AkW2E)5~EYBtSm4v zu+T;fhI5e~04OcN6B+GhJmSBn5^dTgO5%~ZZ#=n2#Z0G6qEl@pYW({uORCE#!u zQ$6m)eD7pHr>pRE>zo5W^JnF97E+JXl;_j&_VSeJ`(>WdcNO3wV8!71YMIEpgjotf z@}#MZyzTG6*i~Ki$I>os7Poq`XlV8*_sK&%QHF>V zzsNX`(w*7MG?Pj0u0}@2HTM)9f^j{LlOCdw3W*KK*I@mWkXk+8*2iy7@Up76pn{S5 zkZbGsyTOwm28hZcU*$Vm)W;l=s3m3!VJ3N;IOxAoSsPGD1=cxTL*bl!;r^E zjKh?AM<~v5^a908H=m=2J)?lQmGY4=-F_J&cKlZ^S-KxOd8KS1Sl|z79t$nw9(@wU zWq~cbc#oYK%f&v*r<@THARoEj&ab~~LOQJE?KL{JG0N+QnV_YWe1a5};h|<&A6bok z1ydR297c{e9_jLY58qtxB%J(FjG{{g9}?UqK98WDbAXff*$WOUtuAHw<8vMoh)RSU zoL1M&%&Cf{h^cbrlX67rd=kgDXq9i7sj{^SKsDMu+CRM5Vv}h$0a0sv)mUkVe_&1D zrk9~I{CQ(FTRj?%RYcrZUtfY>*(@~Z%P!@M!H;F(plJ2#?gVHye#XU1Q*p}A+xL!b z#9^Z8mlr3@3)edcPHJ~{W^q?|oc=Y;!9hv&ZJ}7+rh{DMCaZj?oT1IZKeakXVfxE+ zVQhMKISmuW*R%i$Z@KT+i*V1`F5IOpGt2_~V#Z}qWgDCw-H)Ma>G@ra>Cj5M+JCO| zd^$7u(B{`H*+-3O5eIYeSE>yi%&Ib*r%n^h3rZtfzjbeVtE{-JT0>LhWxw4b*;xPy z-P>noMVp)ZLvHrZsMxfFS8fJoWW|;@NuSLu$u8}YbL*JYlk-Bu**$Jr>%5zeU$Qu4 zq|b1OhC`K>p$NyF6pp~GS!blWhjmA2vids{yH1YB2w`bY!%SbsrY-N%0?+gGlvDbK z5={x59wa^Dp}Tl7T&p3$*d}37`Q-X=rE@~2)%XlOEXE0K-F;Nwzxe%V>*p!BNT+7X zbK!3xKscjMO2h!pfP`l`p*9ia4JX&cYGYD+MPBuA@fh zZefEvk7YaMI89|z*Qz*KbcVh$w5+X<#g=6CV97UinADTsZ|34cZ=w`Dd2yesrY&8*{-r3j0xAr>|j>)X~+^-%p;zw(+j{Drl-+xTrLTIuKm_0yGN zbIxw70atBjdjZpI1=`XMSM{DZp-wg@&a8)_iZxoTfigDOHn)VBUnYGoz03w~n!a{` zqP)O?Zbse}N)&J!<2fnij7|9+FHMS?3~IQh@Unha_C>{QR*phfP5k7H#7^Kl^&{o=;AP?tvD7BZSl_Br4^4{9 zG34l}r0uA05bSx`MetbzcNtDNo$iOs!AZ_n*NOVWMd6g^d+_XdYgsdXPfQfj4c+{d zS7_$-WYoRO%dAn}aH^`(ELh<(G(|`8;_`hkyxRx;N9pn^`iH=_<>Q^1Q;6+|-1IBi znn6^jpRn#cTU+UiN)XY`K`(A42dSy4dyG88>;JqzKfKZrwHGiI9BuR>%R+~ziq;wnXS8abF#SjDQQIm*~b$uo=2tSuldTAY@V<(xC$Jjn=W z$Y`PPdzf{9V0e30q&kC}6DntdCX9+TMHGDj*!tZVvC8v z-<#!?!%YQ>%cCLav@p`|1(j}HTW7@s(>4V;T2-|oFh$nSrvj*kK4A9aVvob`v;Jfz@7KRm{al9$o; zZ(bj!&vyIklL!khUbc#YM}r3Kc&Le61m)!DihXqPJb9WfzA^4OQb{^69LvH~P)(g- z5k)2hcza_G!Dr)U5cM%%2vsw?o_Vl16s*%Q1TF2Tx3nN8jH=i|x3@ergXcM!g&`57}a; zF3#mB$WBXTc!2Q~J51E%mKnT)%ecG~ChW#KMle@L9qIpOt_wWh7%!-eGnI^#Z?~)Wn<{!`7CC8z29kCijO}Tg z+#Pmdw0*k#`nte>I(GuMJv9(s68Vy~|B#$vkvgLDy(DjHC93KODhxChn_q1tmcRud zQ)42Qt$NVSX(}G%JArqz5HXGMgSoL0s`v&1tIej{D2WM ze*zFV0o$*i0LN$d`zPS|?ST9QHlRMppI`?Rfcz77fd0=H29TI|cz8HiobBpcywUR} zf&!^Y%v^Q;C!zFB*u?pHAlQKdL!S6>%9QFm5f_J$<~w*;v;2hgL>i*Twyd{LQ=ndj z`K49Ee-Mfc&K?ImG2lcU8E8{F@wb8l(|2Uif7tqv;&j!C3QHXYo}RpWM#^YPO9M%# z;LVie;(zX_{@4rh5%><|M?%a*aX(6e`ouH!#VzwxqfEClIomx=~)sC zy%XiU6xZp-FR&Pam$P3~455M!1%jvO)R69&|{eJ1@oLmdd|3+ zNp>-jOm;luWoAFKc4_vKXiN|Kvz^{!ydX*!34Ql?f7bC|5!pvbH@wbk<*PlmR|@4> z#&qdPL6_LWFfJ;zDdRK&i6ZzP5?p;_?OAMSUo1RWvo~?}$Dgr&9^OD`hAxy;e}XW3 zjX;9x+1AjD!4eW3Pwr{}Q!<0tBLV_*3iTTAWGjqdfbj@y&lO{0R-VzHf69vXNMg}M zAao?O_S?lN_SW#O`Kd-gfn zvFrCoZ4T|0m7_MA+n)yGy!i5<|H2>qS<*V2lYDb?xmnceM z%Dm@FQ}(vN1G9*q+>fv86p9y+@aa>&iEb5{fOD6xQtw*==EvKRWuMMNbr&zLl>bpJ ztvC@UP6z0EX@Hs@e7?_p__*^|CcI#1Z^?^QolaX#l?uu8)pA12Qp z>M}AK6q~bspK7Vv$JOEEM*L)G!MGQM=~t%dYeBA?69m^s;j8@{NKX&n?uv@@B}xxJ zTa2+2jRxnH_re}39$jv3u*C$liyc$g)`DO|HTL>^B#-vAvt6}rGY+nLq7ClHzY%O& zi94U>r-cc#RZoyQRlZTe+U}XJJr3IVs)` zo6|gIv)AUiZG5B;^GnLaK@$|c4pyHjI*+G$?M@#FErsS*ZL03K45x&T!@wRKB-9pt z((5-DVRg$_R$np~=xk+_)o;)m9*yEH(YGKCwkGa5shb9DM0k+lYIxlZI%<=H6ifTa z=e?qe4i_8ye^=KL?T@i^zOBSGcVp-yGYlQuKF48Uz0*{x_gRp|MlT%z` ze70z>{;ZlAv@oQylcpz#MuP&=D6H(J9S=;_tBDA#M2ihUB)!lN~E~#hoQd`rXfAz*$Z5c2hw! z-E(3z(nA0IdC!pq6DoQg#c)G&6(6`~xNQom!o69;X1S>=63Fc)y>a*7;b9uIo*1bGf6FQz+6V{~ z*0~naN9IknU`rt7v5@eT*h0*d-Q_C#Hb6-=h11n(0Nx-bi=w?V#NJF|<}t@c_~7Ej zWP}_GQ%t?-o}pys{q9(=7LR9!1_ih$)?S=bwX;nu!eL-Rw_OlW@5rhNShLLX5;3{-NYHPc6wth zJr}gw+d-)vlj?{1d-^b=wqWc~2vQlGzDXw(R1C z*w>F8zuv`J(EHx>tg;^*EX>5U#~3B#7Iia5q1xTQHX&=Rky_0%=J zl%2{ItJ1ljNdCE>+GqW+LF~;#Lbvh9%ki5QCzG@JN#VVpPS-aY4e|YGldU|Jef}dM zB=Pc=@db9ogtqa+gm`nW5&30J$EFV1v&X7RAN+ZQbN>cD<(IQAcT@wP&aI zj3TVqXPz?~R^HlRgJyyne5+wHwYz|OxagWP;$FOz7a9!{3y4e`Bv!fJc`j3t@ zT~kF{U=t&GwM)XvjOp*6OZz^G8pN!4QS1FOk1gJPq05dSY|mKieU8mj+iyfxk%$^M z*7S%{>FchMFOWtyy6Tn7y=ltXD*w3-+uR-oPh~?xCYOk|g#xIP_d#%2;PW_>(s~xx&5(a<5M8eIS=0ovSC!T7)rq5WE z;;msm4?^eNCV631WOG(%fO$Y^rvGlR4*g#<^4$-DTC>DYlQmMM2O}b^{sw zG=0NuO9z2D_Vw&(<=AW>vqYm8Mt|p9@adSWORAPxwrne}**JA-tYhxkX6Kn2Uu;5Z zlr26XG!}GpTP(eLH-f%`YML%>^n)A~V4H z+jbS?@n~^bl_JyGs0e#U9Q)}{uk4%~O&tah-ZFx|hFgbJ@(;a}X?5#i(AL`-@Ozd; zhh!n|ZtXaUo9i9YyD?iGuujdiVh9}@6{2D#=Y78Jo4cV+gJ0cbIEw1_ZImQnq8&6v zcC1x|G_ttd74}jKu03Y5GT7bhyQH=`CMAn@9(qxaR*RKs|9 zud}nE4FW#AxI(gD4t}$eh5oTft&(+Nw+~p~h}=cjS%|lI=!=*v2?p(gvYT98n{k2I zgjrBy+buxMW#)8aqKbjFT zVyH5uBG@w%@wiLht`8eGm68NV|1UY-X}``3g=e*9=67^6!D{k*P<1v3g>@JwS5ES8 z%iRHs_y-8Ga&IFadFTSsuMNN&$5a_+9#q+mvo$8JB&_B%w8qizw( zb&CN=PyBzAnL)CC=0N^re?~%uCg*K0o6YvB4KAL8di%wfJD0fWGrS<&jX>1m1%`$^ zh>#j^Iu=XS(5`kCt=5-5BV%OLub8@6zyBYlQvaWGu>ZeY7&kDPzDzrw>>@kA|D6@T zq~(5U8C*%$z#QX*BCMUTXoi_5niB+RYHf_%1LFY$1eATegCjOeder&wO4o$^@L+1w zKKP59I8wj^C7r@qL~-Kobe2rm1egEA6P)s)2rKu}b7`W!q~PK`fIvs9NG#UAlyMTq znx;0f33JoSIXU}HjU+pDrk)4(+j>vgV>I_tDbA2{c5;N_KnbtCYrIo(`it9ywMVG) zUy)?&Bqq(Hu%-!PSm-z=&~)lgyMm|#^^81S3WtjA7ZB=ljKX~ML5+lj#9By-yrG(^ zcxzH2Av8J}%pqO6+fiP^sk3^gnjIu1{1WN77zLATVl>5;0+h&osBiHrDorSY62#wj z6MU`kn0^rlhKYK(knGBXAxU&P9qNmr$X5*Vm0%!`G@S7y$W9qJ3ZOsbu+>U0wox4o)5^M)r`N#N}VRz#)s5vNRA|p+f`+&?XHgT}@ zty+U(aP@L6x#qO|R5G%4=;iNFf~^m=vwCxvO31ZtQH8ZhDg~XgNi!R)`C$@rTvRCF zCK5U=1oWOwhL$5S$)`su);r016x!^2v4R{OQ)%OeI4Q1qxi;2yH0#M4{bHu^F$x0E z=_`r^PC9p;GXX7$goG%sM+5-Vd1+axF<$s_K7ijhE7;$D9s~0{SAP!^eYcdP$Sf!o zfNWIkr6YmGZ5R&Q8i1@{Qf-bI1@(j#f#%;VmL~o-LufAK1 zeskU~+uKWuWgAR9qE5nEO=*I5xY16Xz9I#e9Gsclx;Sow-EzFAs-%zy_~aodiC#Fg zIp11);kYgGqtBj+cU0HXQqV!~>i$$#S6;y0TRUP6Q&p9xBLdoSzwHDsQDvsxhE?D{ ztaZ8T)dabHPHst_&XuQqWV7IRilY-Mcz1RfBXv~@!%O4-pbKz&#AY_8XYx>DZJ-ke zMokzVWn1h5xt)gdV4hRjQ4CNETqCQ=Tdi;#dopvfRAj;1FRik*aCUh%Jt5~6N!TFo z{kmSyVCXliPO}sbTa#CE6S8y2d5)Z5zh&p|yh)F!2LaTdV+D2riN{zAByMYxxGxeA z;j|P6svD*Jf#>gB5=`jFM;_GeQA%JBF2eFv)g0Y+fr10@_Far_X?|5IWXMA z=cOD7g&G#WO{PN}WFRr7U}{$$w(XpQ zMiuB7h2BQ0sg6G_!7{~`m7omAT_bRUJH1{o48yox1s5(c*3E8(~r!OSM=+*_6hkvpqY!N zYKXVKg_}r^-~cgNa&;H!9VOK;l1wDExTqOA#1QJ<9jcIfowD3mt{go$+=VG#yp2Fm zQEZ@MNoLDU6 zEV1f4%@^4%;n!21K_@sy+uVoW%=qpWgQ;aH{b*@Pqa>!D!g*wQlrCDd+5Nd zn;T#d2+%M>r?g5Q=}Hpa`lF-vM`%*i&d%qbwZDY*tcF?o3Vr<)W|PF}j+bc%gT|3$ zz>B<1cf5qoW&}V|R9-*HgED|~lu&bF;T_)NgN@CV(gYPHuTB1`RpmBI0HFy9H`Bg! zP0lJ5%4b#hI=}6BbA}qx30xP_C3*h|pOY>1vK=+o5vOU-zB<83!GdNr=L?+)oB5<^ zugrYqv+wl{i-PGeH1+4(TWdH@fJHRB8Y(rf&k2VrLq1q^rt7Si0GV99#j3kyAX*H_ zA^6&qPT)ptxq_a$SL|xd&cpDz2Gs{I5ge21MlDySJ|`Mu#P5E%rQPK6{n$0zBKCj= z$q(?+BeW2%>*V@dNuuoG4+;AY~nB85)%KQuH#>+o3u=X`E zkaECIOpnf2+2uRbirC%!P#1EK@#$E1aku=zfX+vrA&L}+*7sLz)f-Avw~lQ=ioPQE z3lt!mNqpGSAuqrSg+pc9N@x=E0JKvEmV>EBsjeJ)ncQV&y(u3K9 z%4oZV+y!#43KtDGn5~5z-?*SMH`*%@5W(44b~l5y!7SzVzItBT6)CWPf(=slyJ+@r z`{!9DV-rk@K9!7hXzlIbcZ?}=y0M?e1V}m7%}1o$spl$CbeqZ2`@7~b&;G@D?`FA` zF4TD*h4sQJU($EsW88pxE8TL3vBU-P1BQL4HfIPP?o)#W4AvrNE6yhss^eysm?@Ud zP?e3=9&~_PEPPWXuW-8WMp(A=RHmBX=XX*rTs^HEX6jcv%;zi6bCOGy@HFoDG3yPo zDwCj2uPk^qGEOgd4ahBv4~Cd59-QZX<}K5vVCjti8Gh;F2Sv=;`H0+wVa7Ce{w#>$ zpC|IWY2cS|WzMd6JYP$6i*mG%9kdbw0*_z6{_8o0eIZ!EG^-Gt`w8bTeq*d|D5#8HUKD{?>jSW}kdYMcNEo%2zi2hVH1zQcr zxuGb%bNSXzh0dXQGoKHBr5gLPF{Ynwnbt;PBgR-{5|e$qo_Hem`5sz3e|x4a?~T_Z zLF}@73lPdI0?0>6!?odll#BCcVIq=Ir;eSi>u zJIPtCGhfEU^n#2eD`Kaj&HFE%op)3d>(}o^Komqkn$oL)2%JNaP6VVw0O>VK5fJG; z37`}a6p*e|Dbkzt-Z2z`&^v@)lh6qvgg2h^-gWQ#t$WwH_x?Gv)~wkxv!7=_``MrG zo`Z9%0>Uz3#9=>hl?`&W`3h8W1G^hW5zYL-@#$)Xle`kW!B$9qa1De+{$9uZ6U%z3 z1jF+Zm9tUq;K~kXuAtiO!J2wt==g=1%Gs|Q491)=j4>67=OB&79TG<2mn127J^l~ zw0;g`lOC^hn{E=?o0{45Nfu-24oHA6`S!pk0~(+(Xovec7hSxS+@pH#y3)^mxI?uHR>uL$SdwGo~PwY z(?B3-0XvkMp%$7TilK7Bc^reQwT)9Vx9gX^9!lBMg9R&QhiY9fSAI1kMdOunEMac9 z;3hxNB8L|Tr&J`vMYDxkrL*8LH*}qWOySkvkAyh+!Ruk7wr#9aRrpqs9-fgWAiS1{ z#xHZwf*%xJ56I%|Ut+$w%H@D0@AjG6m#Vqk9;F18Mml$2A1AfWzu2sx)7}~MLKq!# zq$yMCM2DmP>W@p8zmLJ*s(PW61JfO7)}Q_klL>;JS0~7MCb6ZK0-@3_0eB!Ri060gq)1gaAy#rN3K+N=0e3c)1)5rX`=2_r* z3Mmvfce#4>f(yb^S7FsH`27LBU9~OxZ@g{6g3|tUOYP@RXqz|kmlSe=mkJl3O)wv_ ztHN?z?wK1oPVdaTlSKzNC0%0_*hnkp_>t!dsvB2wM<{w4po4#`@bw!qCi%xM5ylL& zEx4JTHFR6E3u@pYv058e34yz)04$g)#@lzw$WrZFUaiFuc`9jbw^V)s8pTcTM$6ti zX1j9geUtXYvR9mDcEh@>&08gFAzKXcv~)p;t8K4&h|}l1++pSW?=7aRnmvwkNTjPw z*pj&qQR<6Z56eb>IoG?&Hf^c-oRiFEO|@Tk7Fa^#M|s zz2gx&E>G5_i$Vub_xWrOf9CAW+(F*(u@a!kvd_IdMbFZ#!3wuX$5h|P! zQ#wp99Vw#DT;%!d@3c0VlE&M9-uhMFVm?@y4MiJ>;<5QAB9`qUQqKM{OV1@em>3^i zNGr7?bVvuZ!i?xMH+n~YrJrR1ECV%mHe=D(Sx(Ofq!ktzG{%xV2iSEblPL>%kAL?F zCFtiCBKhl$KSt)L5y^ZwW1Z=PSxXOUzMfa0*(kwXgM+s$WBp6Ef9`GHs+aN_jZ)5m z(XFK$)gx(Mv^_pR+XIG9xg{w)tdu1qo9-vy*>O0J%=Qd9Gn%fsdn#s90c!58y%x7p zEXbKD`FJ1Mvq>A4pTPgRtL&D!vKEoY zWkvWEj-ITq@#>{iVfW7SYGSfds~0m`eNGqIQ?l{kwK_5{To z*TZcQ6c04m6QW+5E*FQ}CJiaO0i`t9%v#WgaKL7GLBQ{@GZ$+w6{E z0so~##N-(h7iB58P5Q=Wd-3eEgbbfxu!;)eHkB3C&WHlXd*7(t+!uZ`wCbJ*b>B|} zMg<*DQ6!%R!N-hx`|?ev)J-%v51-lF0mzTH=ajs{z7;Dc?s~YMwC(G9=~a{0etAI$ z@Ve-SzP!<4K-Sss>amHEE(~`Kv=7sFX9I*(_-t_naaG<~Oiri!%Wf61ey@Ah_!qaM z4Nui9V@eu|bW3kc5RIV7S1VC}WVl(m_SXTnF>j$kqS<3oR(<6OIdH>(QTO)F+J=*T z1QmZSGg>f2fj)ts2y=lVDUS5d#sbXhuPTc#E*6Cw0wP1j^sFY>{mzyuGM#1HEYmCQ z*6RY3;rcB_@Ae87j&|@{P2ZWhwoWa6S?KVLd}QwBGkai}4CRp0W$AcG4K)z0aumbVhFP6YW0^>+{&@&G%bGr)rg#Y@Jybp{BKHn zq=Ae+F$(dB=!{(Bmd)8Wit=Q=!6o&v46Wol+YMloL^a;7-PFLj5aIsU+1!|wUZ=i> zjm`8$KZYb)pW(D{KBtc>2syCcTRf~PNjD=YfkDeDr+ggGab;1!Bl0oZp$BH}(%un? zQxqM+S81%b3bq@}J-?@(om7n!VGhrR#cs%2wxT{(OnnOVV#NC$J*n9K%SOZlq(mhS z1De6uTb~BT%X!9?gTeU1ix~*^9SQjLF^f@ISG)+jv`X2hyIIm4G5K4~g%*%77TkqY z>ItEK7s)CIPysG8Bs0*pXtw){QNm1u@^@(-dEr(UHtxk`dXe?qQm=wzyTh7Jh&u&ho-QFu zN;Xs6GsuTu2UD7rytF-Z=9dbOIs7Ry^69HqR-=d3FQKF$&zVjEE^neqIVL5_4ef+k z12RpywyW3UDun-RoPw;5Kbyz|G02SU#J)!JsQ!;sAi04t*qgk>apM^j>Ul z`NHpcKwVx~5e8oip#r(uupc>4)Vs#3*2g&9lVZ$X^X)%lAGMl(dliJ7I(6Qs!1iZj zMDWLpKaMZk7Ch;B$2*0XF=3><5|%|tf2;KpU+S`$zi;l{^>g`kxXI}=A>&ofDiMEm z1UMY|@HHK0$z236*U?BkZ@HZUU+7odkd@T<&dmNTVK`ij$eiz-P4)n(Ah)r*gswxk zn@VVt8Pp8Vy1*KPm-yyp68v5YT5~*$8F}O&rDQfE{$6ExYJaZs^?WkrYqQcBi-Kqy z_YAI+x{j%C%ROIrqX{F5ecVdk$1h)xT0yegPANbe0r(j+)@>hc$K{U$AYVIcmOclrEXRiMWeqWWgBoj8$!ELK+aU zzpFmiwh8lUfhk;K{S&uXr3ddOnkh9uS6=Y0__kJcAiSaukj(CmNOF%waa%FqZ^w3yVvOPCVluqTgi{rD+eKn1Z^>%$P8Kwfr*Cz&Jc~5g zx)B#2sMuDpU+hEX?_1tr!&dqz&#p+I(&p1M?OEu3;z~QY>CTJhp&G^&;ZolUc9H90 zTFp)_arf)0La#*X;KgxZ!w-s}Mg9^tK6BU^Z3C0y4*jLsdi^kefqj5rNz;gA9Fc#y zqB~x=b;BlP0k*z5FNlbRkGK;!6J8J4qBiSH>j=U`=X9}+3%tKyi-HUt{?zl^Tn+Jh z1pn2v=4YMt;N7*vfAeLT^N4iuL^_cIpejM*mm=w%{YcoZvwFM)+a@N)W?S4p${8sP z;51-e5d>UW_p)5Sl^`UVfXJ<hx7$(zY>4{^ z><0?ac!!zIJTT6{8Gz+-`l#)r&k&!8y_lK2i1oMZsdtm+Y`j{F)jq!bW^z`#EU@b6 z_5?gN4SR;TeZAt=V5d=ak!zwrznSEgXH(DJy9;uI{^Ik_Evw({K>4J#Uk?j2W?A(l zZ+mJT;4b80>u_^WTg`q?z#-a%m5s~cxp81s&~ks_$w}_z)3;{zzkWc)m3I14h4^$@ zwW{_-$`>IvlT+NSfvl@GH*?4uK3B=ux+1OHj11pir*1$f`9Si;1JN$0MIQhjlC+?cgvJ9+8R37garHBYk8D@W4g5fP zU9lLIH$zc#aorfmRg441z?|ZuLEAel6UOMRC#^1uSU7YvzbsREc&Oi4Uh8WPD3$drRW&N;h{{ z)kXvc-P_yE`%IAL)c7ihB$ZE~!g5IqKFOX;!CEjE>NPG~VGb+ESZR&UhZSm(Zfryy zuAqwv6)?mEK_0*i0K9X3qj{v^={}yKrss~DkC{)M>VnuFubJRK4+f=#CCm%PAbUOh z0d(o3Qcni`j#DolXWr@XFnS+y%%8&bSUQsRuE2-`NbciPEB^!Pwo+Y$k+2)oDkT+N zKNLKga|U;Xf)aPR$qpExcHtqZ{a^NSeyfVU_%_c9k}C|l>`c2m`N_K1mfzXWMNUUZ z_rv3ilcLv*8u?uU=Up^(E3kWr!IfJAkrBppYofefCuy+gN|Bz1Fm z&7qHd+4s5KWK@M0R%6-#vRDHDY)QmPMK;+T5ztsDWazf|xxEgc>ph-w8Ds5+9=Sfe zMAw&I4lAISQtpMi9^iYr>(^2Yk)gLQd#orR%%#vHjl?Fe0))L(Dv7RA8O0# zbMa#^q~}4nJ#^#VRnJiC5iHjaZOl4b7pH4_Q0!ERmI$(d4xL1?rX3i~%KeCGN{oy2 z1G=qk&bFG=xcn77Vhjx@aob7AObR3?BP7L7WZ^7oEf; z)p5}GRo5;j>PJaSTt<3!8BUovwa{+UZt%8?YrEem^u`Sg_cQkpKr?QDiBlzmwyIv& z+CYt%P}%SBaZyxZ754~wmKzc^C+Eq;XFo|yJGM>OAVp9ew2(OjsG8C{r?UmnfdVrg z#s7}c&E)EjuUW@8f*6!lW%rb5y>{Z_Vh*+w?||(%^W&^1F@eq@DkX((3b{EWd=&!! zvlT+*|7e9k*=iukc<+B9NpJX%Wga8;B^rb)_TtoI8xne4o5{wb3F@K}6_^_G;l4|5 zub^j?djBAsxb7c>_unHw-D#G#&1MR>D{xW2iuY>IY!Yhv<}@UJrp?>0$SfB6z4CUq z1-6yPsmuv3JK^N6HJh}OWj^zfkx#?eBhk$?tkz51e0q|vYjy%0#^Y?0UM7bV64L&} z6wxOuvfKpf7=K=i1|`5pgW8x>Ugmsu2h|A$#r zMKnEq^I?ho+dh#Fo$=UVtWI_v0c+NsA*kyz%?J2L2D*RaL}fKRd%F54bzMgM?uh^o zpAO^%70WFAx;a!mEukc&3Lr*a2DhaeJ=jcGNF1y=K6*V7qa)319&=Y>+Z0>vuxon3 z3r;JjAO0TasAe&xUfm{eHA2p1BS{bXB7Wh z#F9=MEjn%3)y3W7a%xnn1aJ89lPq(|YL&_CzH5bv#An!Ms8trq zl|Who9rv$zj(chg;>%U&Q5oVaoQbJT1%taD=ZdV9@9T4w!5bgE6m^=rLG7^$o~Gt-5pq{W;F=OQf+7>QP?p7MXMy!zee8Q+al5*Q7SF2*4`E zaXZO8W1HbiG|EO(*DOJ0Sc+-88bIPwCIUn19axyk2inx%#n9Erb+3)`H<$RP?iSbD zhsl?h7@P6&&@{z4Xyl)To7>lO-9Sn|;+3pc{BeEUp87}d}_hG-z(6bfI_|Q(GHU<3?eOcKjaLGp$ zE_sZSMtn-4xQ9V)(nj7dLznZ`5WR%f1$m{k847+k#WY0MUZ^Dbs03}Sb115~2nZ4M zD8(?sJd|0pg%txHY)wy0c>sq#5~!wwrn=8DKR%RgkqUXe-!qTZ)|r^1`)^2P%UYLk zjhq>EI%1@}DqBT!kj{Q9kntJ(enWZdON0qrsTx?a4Rc_GJKwy~!A>CSpHTjvFn>iV zp&N);(*G9*|379of+_!(@c#ei!gryFeI$}K|NBk(9bKwF+)776Z6Sh%g(W>T)ziz1 zHeX6sRu>4oM@czaeckhqfI!Zyoi*K&)5*z+k}^646lA8Mp`oI(5zc509~+Yi#>=Iu zh&EG?5lEL_kt@!wOTU*fPdUeAZw{`F{#YE7v66_$YI#KMA^&a<-Zo{ zLWAg%^sq8cT4L3yUst)Kc$ z|2(ScuAP!hd6=)l{E8>PV76=6l|R8eD=Vw$=xC94oadW2Z}jzPqBP9R%mM-e4Eu(M zhX)5CE8&a;z-yFXC+lK0>k7%?lK9-gM9&PSXGRa?FhY>#`s^#H zWdnZj@YK}W2lFgpS6eU-4YF8*_tKnvx`)hyJ}e!^8K<^DQ=(+B%`#@=wxP!6RUx7# zrG$O3)xmP|Lr8|Jr@KGeoOxvS6VkbCP4l=(OB?CrOXt%6~g7 zfKD!rV>n$plw70@V`FAEEA=Bke^Vs*f+E!)j|-^jn3$kzRkDDQ%r>WT7^4$BBNaK- zV(wC&O@F|JbL1tuS<}m^QZvuZizz_)rCgLB`z!EiSNCteB(3T6f%S$3gA*_(Bux~x zSs;$31>cR`jSUf+F5nL*tXiarWS@0&)o$y#l_nS*RN~C|$7z#glxjY*xT2ihz{cI$ zZq*GAlarM|>>>QlF@JS+HUBTT(lP0ocMFrEHV{}vK}$=!zoQOOJMVef+H!MwlM2q# z#Z}y`eULVC{z*`XMJ`u%~E5`vnNmOItKi+P-tLF|p7nhWm<(E}i zWMEA9f9fDKTvs=|6gfJ&l0E7~_x5nNN0W%RJhsjgl$e|-1vyI(OEgpg^q=#-N|S#I z2f%4cuFri!Y;(DDX{(PrFIGmT)l}iT8*a293A=e}G&(cm0sDgtaa!|!+f>!~(Bdv7 z_Lf-G*>d9$x78D@YcS;>Vb2pEEdi-5z}oM=KGTDT4nQE#*qA|coQzNh-DlO6gj|1F z=dX3DrVvbFod8bCV!J+6Pmokei5Gf)q_bA+fo>pe@R7=f~vX&De6)- zpEq?8@(%c0>NdgUfxgyNj919&H?lHn78J492STYaxKog`Ab9kJvSx_jtikP73%YdP zyGCc~($YLQdSNJ}_tTa^*I%Kf9)PRercZ|MIhTR8aXj7Hq=oj8r=XUgxt~10_N5>v zNgFvXYuxRVh%mxh@*S_+Vdw1Zw449-8h!kkL2kFz=v)??l{*X9=nkAEa*}HRGCF@PtVMrx~8V!(WNSlApxs<+djBX`k zT4w5YPnJ?0RW#h-bw11t>0;HouS)2YD(md+$&mEu1GZ4audW&#@d$RSi1KItYrfGg zjF;iSlHZ-~#F(En3x+EBe8I93H2)4i2KMyQwjhh2WrFQ9t9oK`$u`(4Cx~a2@_9(k zs?KD2cAMY;hJ}gS<6&c>CbcxY*6$_wSc?M-*J{r=k2k?LVije%@a>m?N>@F~WJju5(Z+0{CWTG7M_ z6WMX28r<2j##yI@hvPHC9RBgw-$Uy5>fHh*o}UFBZKnD=M^4vU?rx*a?L6^#gk{v9 zX!Nqk0_x6H+NNkMDC~W9kMgVvRn#bPh9kR~%?<4$sB)twjp!T{e>j Q!to6a72xx7rI#W91&NK*QUCw| literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md index 4383ca390b..f75e4aeaea 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md @@ -34,48 +34,32 @@ Once the Supplemental Policy type is chosen on the New Policy page, policy name ![Base policy allows supplemental policies](images/wdac-wizard-supplemental-expandable.png) -If the base policy is not configured for supplemental policies, first edit the base policy to allow supplementals using the [WDAC Wizard edit workflow](wdac-wizard-editing-policy.md). +If the base policy is not configured for supplemental policies, the Wizard will attempt to convert the policy to one that can be supplemented. Once successful, the Wizard will show a dialog demonstrating that the addition of the Allow Supplemental Policy rule was completed. + +![Wizard confirms modification of base policy](images/wdac-wizard-confirm-base-policy-modification.png) + +Policies that cannot be supplemented, for instance, a supplemental policy, will be detected by the Wizard and will show the following error. Only a base policy can be supplemented. More information on supplemental policies can be found on our [Multiple Policies article](deploy-multiple-windows-defender-application-control-policies.md). + +![Wizard detects a bad base policy](images/wdac-wizard-supplemental-not-base.png) ## Configuring Policy Rules -Upon page launch, policy rules will be automatically enabled/disabled depending on the chosen template from the previous page. Choose to enable or disable the desired policy rule options by pressing the slider button next to the policy rule titles. A short description of the rule will be shown at the bottom of the page when the cursor is placed on the rule title. +Upon page launch, policy rules will be automatically enabled/disabled depending on the chosen base policy from the previous page. Most of the supplemental policy rules must be inherited from the base policy. The Wizard will automatically parse the base policy and set the required supplemental policy rules to match the base policy rules. Inherited policy rules will be grayed out and will not be modifiable in the user interface. -### Policy Rules Description +A short description of the rule will be shown at the bottom of the page when the cursor is placed on the rule title. + +### Configurable Supplemental Policy Rules Description + +There are only three policy rules that can be configured by the supplemental policy. A description of each policy rule, beginning with the left-most column, is provided below. Selecting the **+ Advanced Options** label will show another column of policy rules; advanced policy rules. -A description of each policy rule, beginning with the left-most column, is provided below. | Rule option | Description | |------------ | ----------- | -| **Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all WDAC policies. Setting this rule option allows the F8 menu to appear to physically present users. | -| **Allow Supplemental Policies** | Use this option on a base policy to allow supplemental policies to expand it. | -| **Disable Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is only supported with the Windows 10 May 2019 Update (1903) and higher. Using it on earlier versions of Windows 10 is not supported and may have unintended results. | -|**[Hypervisor-protected code integrity (HVCI)](https://docs.microsoft.com/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. HVCI provides stronger protections against kernel malware.| | **Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | | **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, that has been defined as a managed installer. | -| **Require WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows 10–compatible driver must be WHQL certified. | -| **Update Policy without Rebooting** | Use this option to allow future WDAC policy updates to apply without requiring a system reboot. | -| **Unsigned System Integrity Policy** | Allows the policy to remain unsigned. When this option is removed, the policy must be signed and have UpdatePolicySigners added to the policy to enable future policy modifications. | -| **User Mode Code Integrity** | WDAC policies restrict both kernel-mode and user-mode binaries. By default, only kernel-mode binaries are restricted. Enabling this rule option validates user mode executables and scripts. | - -### Advanced Policy Rules Description - -Selecting the **+ Advanced Options** label will show another column of policy rules; advanced policy rules. A description of each policy rule is provided below. - -| Rule option | Description | -|------------ | ----------- | -| **Boot Audit on Failure** | Used when the WDAC policy is in enforcement mode. When a driver fails during startup, the WDAC policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. | -| **Disable Flight Signing** | If enabled, WDAC policies will not trust flightroot-signed binaries. This setting should be used in scenarios where organizations only want to run production binaries, not flight/preivew-signed builds. | | **Disable Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that’s only writable by an administrator) for any FileRule that allows a file based on FilePath. | -| **Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically loaded libraries. | -| **Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically revalidate the reputation for files that were authorized by the ISG.| -| **Require EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All Windows 10 and later drivers will meet this requirement. | - -![Rule options UI for Windows Allowed mode](images/wdac-wizard-rule-options-UI.png) - - -> [!NOTE] -> We recommend that you **enable Audit Mode** initially because it allows you to test new WDAC policies before you enforce them. With audit mode, no application is blocked—instead the policy logs an event whenever an application outside the policy is started. For this reason, all templates have Audit Mode enabled by default. +![Rule options UI for Windows Allowed mode](images/wdac-wizard-supplemental-policy-rule-options-UI.png) ## Creating custom file rules @@ -90,7 +74,7 @@ The Publisher file rule type uses properties in the code signing certificate cha | **Issuing CA** | PCACertificate | Highest available certificate is added to the signers. This certificate is typically the PCA certificate, one level below the root certificate. Any file signed by this certificate will be affected. | | **Publisher** | Publisher | This rule is a combination of the PCACertificate rule and the common name (CN) of the leaf certificate. Any file signed by a major CA but with a leaf from a specific company, for example a device driver publisher, is affected. | | **File version** | SignedVersion | This rule is a combination of the PCACertificate and Publisher rule, and a version number. Anything from the specified publisher with a version at or above the one specified is affected. | -| **File name** | FilePublisher | Most specific. Combination of the file name, publisher and PCA certificate as well as a minimum version number. Files from the publisher with the specified name and greater or equal to the specified version are affected. | +| **File name** | FilePublisher | Most specific. Combination of the file name, publisher, and PCA certificate and a minimum version number. Files from the publisher with the specified name and greater or equal to the specified version are affected. | ![Custom filepublisher file rule creation](images/wdac-wizard-custom-publisher-rule.png) @@ -115,12 +99,12 @@ The Wizard supports the creation of [file name rules](select-types-of-rules-to-c ### File Hash Rules -Lastly, the Wizard supports creating file rules using the hash of the file. Although this level is specific, it can cause additional administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. By default, the Wizard will use file hash as the fallback in case a file rule cannot be created using the specified file rule level. +Lastly, the Wizard supports creating file rules using the hash of the file. Although this level is specific, it can cause extra administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. By default, the Wizard will use file hash as the fallback in case a file rule cannot be created using the specified file rule level. #### Deleting Signing Rules -The table on the left of the page will document the allow and deny rules in the template, as well as any custom rules you create. Rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. you will be prompted for additional confirmation. Select `Yes` to remove the rule from the policy and the rules table. +The table on the left of the page will document the allow and deny rules in the template, and any custom rules you create. Rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. you will be prompted for additional confirmation. Select `Yes` to remove the rule from the policy and the rules table. ## Up next From 741b744ab13663438c2a1d2365815a81fda795d7 Mon Sep 17 00:00:00 2001 From: mestew Date: Tue, 5 Jan 2021 10:39:55 -0800 Subject: [PATCH 061/206] Fix link typo for language handling --- windows/whats-new/whats-new-windows-10-version-2004.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-2004.md b/windows/whats-new/whats-new-windows-10-version-2004.md index 8c86914b6b..f8c9549d00 100644 --- a/windows/whats-new/whats-new-windows-10-version-2004.md +++ b/windows/whats-new/whats-new-windows-10-version-2004.md @@ -52,7 +52,7 @@ Note: [Application Guard for Office](https://support.office.com/article/applicat ### Windows Setup -Windows Setup [answer files](https://docs.microsoft.com/windows-hardware/manufacture/desktop/update-windows-settings-and-scripts-create-your-own-answer-file-sxs) (unattend.xml) have [improved language ](https://oofhours.com/2020/06/01/new-in-windows-10-2004-better-language-handling/). +Windows Setup [answer files](https://docs.microsoft.com/windows-hardware/manufacture/desktop/update-windows-settings-and-scripts-create-your-own-answer-file-sxs) (unattend.xml) have [improved language handling](https://oofhours.com/2020/06/01/new-in-windows-10-2004-better-language-handling/). Improvements in Windows Setup with this release also include: - Reduced offline time during feature updates From 61a2969d920b2c5372ecef15fdc70421049d279d Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Tue, 5 Jan 2021 10:47:48 -0800 Subject: [PATCH 062/206] Fixed a broken link in editing-policy.md and a recommended link change in wdac-wizard.md --- .../wdac-wizard-editing-policy.md | 7 +++---- .../windows-defender-application-control/wdac-wizard.md | 2 +- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md index a239d415ec..e8e812e434 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md @@ -26,10 +26,9 @@ ms.date: 10/14/2020 The WDAC Wizard makes editing and viewing WDAC policies easier than the PowerShell cmdlets or manually. The Wizard currently supports the following editing capabilities: